Fyi... Regards, Ron ---------- Doorgestuurd bericht ---------- Van: "Larry W. Cashdollar" <[email protected]> Datum: 27 feb. 2013 19:31 Onderwerp: [Full-disclosure] Gambas 3.3.4 Directory hijack vulnerability Aan: "Full Disclosure" <[email protected]> Cc:
Gambas 3.3.4 Directory hijack vulnerability The gambas software package creates a directory in tmp to work from without verifying another user hasn't already created it. This allows a local user to hijack ownership. This advisory was taken from the bug filed with the developers. Describe the problem: Gambas creates a directory in /tmp called gambas.UID where UID is the user id of the person running the software. Gambas doesn't check to see if a malicious user has already created that directory. A malicious user can then manipulate (mv or remove) that directory once gambas has created files under it. larry@aliquot:/tmp$ mkdir gambas.0 larry@aliquot:/tmp$ ls -ld gambas.0 drwxr-xr-x 2 larry staff 4096 2012-12-13 16:37 gambas.0 larry@aliquot:/tmp$ cd gambas.0 larry@aliquot:/tmp/gambas.0$ ls larry@aliquot:/tmp/gambas.0$ ls -l total 4 drwx------ 2 root root 4096 2012-12-13 16:37 25257 larry@aliquot:/tmp/gambas.0$ rm -rf 25257 larry@aliquot:/tmp/gambas.0$ User larry was able to remove the directory gambas created as root. 2) Software Details Version: gambas3-runtime-3.3.4~lucid2 Revision: Operating system: Linux Distribution: Ubunt Architecture: x86_64 GUI component: QT3 / QT4 / GTK+ Desktop used: Gnome 3) Provide a little project that reproduces the bug or the crash. ubuntu-builder runs as root See bug posted here for details and fix from vendor: http://code.google.com/p/gambas/issues/detail?id=365 @_larry0 Larry W. Cashdollar http://otiose.dhs.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb _______________________________________________ Gambas-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/gambas-user
