Bug#760455: install-sh: insecure use of /tmp

2015-08-07 Thread Alex Vong
Package: automake
Version: 1:1.15-2
Followup-For: Bug #760455

Dear Maintainer,

A patch fixing the bug authored by Pavel Raiskup is available
from Red Hat Bugzilla. The patch has been forwarded to upstream,
but it has not been merged yet.

References:
 https://bugzilla.redhat.com/show_bug.cgi?id=1140725
 http://lists.gnu.org/archive/html/automake-patches/2015-04/msg1.html


-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.1.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=zh_TW.utf8, LC_CTYPE=zh_TW.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages automake depends on:
ii  autoconf   2.69-8
ii  autotools-dev  20140911.1

automake recommends no packages.

Versions of packages automake suggests:
pn  autoconf-doc   
pn  gnu-standards  

-- no debconf information

*** automake-install-sh.patch
diff --git a/lib/install-sh b/lib/install-sh
index 0b0fdcb..59990a1 100755
--- a/lib/install-sh
+++ b/lib/install-sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2013-12-25.23; # UTC
+scriptversion=2014-09-12.12; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -324,34 +324,41 @@ do
 # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
 ;;
   *)
+# $RANDOM is not portable (e.g. dash);  use it when possible to
+# lower collision chance
 tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
+trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 
2>/dev/null; exit $ret' 0
 
+# As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
+# create the $tmpdir first (and fail if unsuccessful) to make sure
+# that nobody tries to guess the $tmpdir name.
 if (umask $mkdir_umask &&
-exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+$mkdirprog $mkdir_mode "$tmpdir" &&
+exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 
2>&1
 then
   if test -z "$dir_arg" || {
# Check for POSIX incompatibilities with -m.
# HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
# other-writable bit of parent directory when it shouldn't.
# FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+   test_tmpdir="$tmpdir/a"
+   ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
case $ls_ld_tmpdir in
  d-?r-*) different_mode=700;;
  d-?--*) different_mode=755;;
  *) false;;
esac &&
-   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
- ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+   $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
+ ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
  test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
}
  }
   then posix_mkdir=:
   fi
-  rmdir "$tmpdir/d" "$tmpdir"
+  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
 else
   # Remove any dirs left behind by ancient mkdir implementations.
-  rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+  rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
 fi
 trap '' 0;;
 esac;;


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org



Bug#760455: install-sh: insecure use of /tmp

2014-09-04 Thread Jakub Wilk

Package: automake
Version: 1:1.14.1-3
Severity: minor
Tags: security

When the destination directory does not exist, install-sh checks if 
"mkdir -p" works, but it does so in an insecure way. Here are the 
relevant parts of the code:


mkdirprog=${MKDIRPROG-mkdir}
# ...
tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0

if (umask $mkdir_umask &&
exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
then
# ...
  rmdir "$tmpdir/d" "$tmpdir"
else
# ...
	  

In some shells (such as dash) $RANDOM is not set, so $tmpdir is easily 
predictable. Moreover, "mkdir -p" follows symlinks to existing 
directories. Local attacker can exploit this to create or remove empty 
directories named "d". (But on modern Linux systems this is mitigated by 
the protected_symlinks feature.)


--
Jakub Wilk


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org