Hide Forgot
Poppler and Xpdf, both seems to be affected by a vulnerability of use of insecure temporary file for non-UNIX OS's. An attacker with local access could potentially exploit this issue to perform symlink attacks, overwriting arbitrary files in the context of the affected application. The issue is still to be fixed in both poppler and xpdf. References: http://seclists.org/oss-sec/2013/q4/181
GBool openTempFile(GooString **name, FILE **f, const char *mode) { #if defined(_WIN32) //---------- Win32 ---------- char *tempDir; GooString *s, *s2; FILE *f2; int t, i; // this has the standard race condition problem, but I haven't found // a better way to generate temp file names with extensions on // Windows if ((tempDir = getenv("TEMP"))) { s = new GooString(tempDir); s->append('\\'); } else { s = new GooString(); } s->appendf("x_{0:d}_{1:d}_", (int)GetCurrentProcessId(), (int)GetCurrentThreadId()); t = (int)time(NULL); for (i = 0; i < 1000; ++i) { s2 = s->copy()->appendf("{0:d}", t + i); if (!(f2 = fopen(s2->getCString(), "r"))) { if (!(f2 = fopen(s2->getCString(), mode))) { delete s2; delete s; return gFalse; } *name = s2; *f = f2; delete s; return gTrue; } fclose(f2); delete s2; } delete s; return gFalse; #elif defined(VMS) || defined(__EMX__) || defined(ACORN) || defined(MACOS) //---------- non-Unix ---------- char *s; // There is a security hole here: an attacker can create a symlink // with this file name after the tmpnam call and before the fopen // call. I will happily accept fixes to this function for non-Unix // OSs. if (!(s = tmpnam(NULL))) { return gFalse; } *name = new GooString(s); if (!(*f = fopen((*name)->getCString(), mode))) { delete (*name); *name = NULL; return gFalse; } return gTrue;
Created xpdf tracking bugs for this issue: Affects: fedora-all [bug 1024766] Affects: epel-all [bug 1024767]
Created poppler tracking bugs for this issue: Affects: fedora-all [bug 1024765]
(In reply to Ratul Gupta from comment #3) > Created poppler tracking bugs for this issue: > > Affects: fedora-all [bug 1024765] Hi, do we really need to fix this in fedora's poppler? From my understaning, it should affect just non-UNIX OSs. Regards Marek
Statement: Not Vulnerable. This issue does not affect the version of poppler as shipped with Red Hat Enterprise Linux 5 and 6.
This issue does not affect the version of poppler in Linux/Unix.