Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution Jul 17 2008 10:54PM
Jan MináÅ? (rdancer rdancer org) (2 replies)
1. Summary

Product : Vim -- Vi IMproved
Versions : 5.0--current, possibly older; 4.6 and 3.0 not vulnerable
Impact : Arbitrary code execution
Wherefrom: Local
Original : http://www.rdancer.org/vulnerablevim-configure.in.html

Insecure temporary file creation during the build process is vulnerable
to symbolic link attacks, and arbitrary code execution. Patch provided.

2. Background

``Vim is an almost compatible version of the UNIX editor Vi. Many new
features have been added: multi-level undo, syntax highlighting, command
line history, on-line help, spell checking, filename completion, block
operations, etc.''
-- VIM ``README.txt''

3. Vulnerability

During the build process, a temporary file with a predictable name is
created in the ``/tmp'' directory. This code is run when Vim is being
build with Python support:


677 dnl -- we need to examine Python's config/Makefile too
678 dnl see what the interpreter is built from
679 AC_CACHE_VAL(vi_cv_path_python_plibs,
680 [
681 tmp_mkf="/tmp/Makefile-conf$$"
(1)--> 682 cat ${PYTHON_CONFDIR}/Makefile - <<'eof' >${tmp_mkf}
683 __:
684 @echo "python_MODLIBS='$(MODLIBS)'"
685 @echo "python_LIBS='$(LIBS)'"
686 @echo "python_SYSLIBS='$(SYSLIBS)'"
688 eof
689 dnl -- delete the lines from make about
Entering/Leaving directory
(2)--> 690 eval "`cd ${PYTHON_CONFDIR} && make -f
${tmp_mkf} __ | sed '/ directory /d'`"
691 rm -f ${tmp_mkf}

The attacker has to create the temporary file
``/tmp/Makefile-conf<PID>'' before it is first written to at (1). In
the time between (1) and (2), arbitrary commands can be written to the
file. They will be executed at (2).

3. Test Case

No test case.

4. Patch

Patch fixing this vulnerability can be found at the following URL:


Please note: The patch fixes ``src/configure.in'', an input file used by
the ``autoconf'' command. ``autoconf'' uses this input file to create
``src/auto/configure''. It is necessary to remove the latter, if
present, to force its recreation. Otherwise, further build runs will
still use it, and the vulnerability will still be present.

5. Copyright

This advisory is Copyright 2008 Jan Minar <rdancer (at) rdancer (dot) org [email concealed]>

Copying welcome, under the Creative Commons ``Attribution-Share Alike''
License http://creativecommons.org/licenses/by-sa/2.0/uk/

Code included herein, and accompanying this advisory, may be copied
according to the GNU General Public License version 2, or the Vim
license. See the subdirectory ``licenses''.

Various portions of the accompanying code were written by various
parties. Those parties may hold copyright, and those portions may be
copied according to their respective licenses.

6. History

2008-07-17 Sent to: <bugs (at) vim (dot) org [email concealed]>, <vim-dev (at) vim (dot) org [email concealed]>
<full-disclosure (at) lists.grok.org (dot) uk [email concealed]>, <bugtraq (at) securityfocus (dot) com [email concealed]>
--- - 2008-07-17 22:21:13.599801352 +0100
+++ src/configure.in 2008-07-17 22:21:03.000000000 +0100
@@ -678,8 +678,12 @@
dnl see what the interpreter is built from
- tmp_mkf="/tmp/Makefile-conf$$"
- cat ${PYTHON_CONFDIR}/Makefile - <<'eof' >${tmp_mkf}
+ tmp_mkf="`mktemp`"
+ if test $? -ne 0 || ! test -f "${tmp_mkf}"; then
+ echo "Error: Can't create temporary file. Aborting."
+ exit 1
+ fi
+ cat -- "${PYTHON_CONFDIR}/Makefile" - <<'eof' >"${tmp_mkf}"
@echo "python_MODLIBS='$(MODLIBS)'"
@echo "python_LIBS='$(LIBS)'"
@@ -687,8 +691,8 @@
dnl -- delete the lines from make about Entering/Leaving directory
- eval "`cd ${PYTHON_CONFDIR} && make -f ${tmp_mkf} __ | sed '/ directory /d'`"
- rm -f ${tmp_mkf}
+ eval "`cd ${PYTHON_CONFDIR} && make -f "${tmp_mkf}" __ | sed '/ directory /d'`"
+ rm -f -- "${tmp_mkf}"
if test "x$MACOSX" = "xyes" && ${vi_cv_path_python} -c "import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
vi_cv_path_python_plibs="-framework Python"

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus