Attachment 13098 Details for Bug 42865

my patch

ImageMagick-5.5.4-tmpfile.patch (text/x-diff), 2.81 KB, created by Vladimir Nadvornik on 2003-07-14 22:08:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2003-07-14 22:08:36 UTC

Size: 2.81 KB

patch

obsolete

>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0455
>    The imagemagick libmagick library 5.5 and earlier creates temporary
>    files insecurely, which allows local users to create or overwrite
>    arbitrary files.
>
>this patch based on Daniel Kobras code to fix insecure temporary
>file creation which is mentioned in http://www.debian.org/security/2003/dsa-331
>ported because added randomness just makes the race condition harder to
>achieve, but not impossible.
>
>================================================================================
>--- magick/utility.c
>+++ magick/utility.c
>@@ -2644,8 +2644,66 @@
> %      name is returned in this array.
> %
> */
>+
>+/* Attention: this creates an additional 
>+ * intermediate directory for security reasons,
>+ * but unfortunately it is never deleted.
>+ */
>+static void TemporaryFilenameHelper(char *, char *);
> MagickExport void TemporaryFilename(char *path)
> {
>+    static char *mSafeTmpdir = NULL;
>+    char *name;
>+    struct passwd *pwd;
>+    struct stat st;
>+    char *tmpdir = getenv("TMPDIR");
>+    if (tmpdir == NULL)
>+	tmpdir = P_tmpdir;
>+	
>+    pwd = getpwuid (getuid ());
>+	
>+    if (mSafeTmpdir == NULL) {
>+        int seq = 0;
>+    
>+	while (1) {
>+    	    strncpy(path, tmpdir, MaxTextExtent-1);
>+	    strncat(path, "/magick-", MaxTextExtent-strlen(path)-1); 
>+	    strncat(path, pwd->pw_name, MaxTextExtent-strlen(path)-1); 
>+	
>+	    if (seq > 0) {
>+		char buf[50];
>+		sprintf(buf, "-%04d", seq);
>+		strncat(path, buf, MaxTextExtent-strlen(path)-1);
>+	    }	
>+	    seq++;
>+	    
>+	    if (lstat (path, &st) == 0) {
>+		if (S_ISDIR (st.st_mode) && 
>+		    st.st_uid == getuid () &&
>+		    chmod (path, 0700) == 0) {
>+		    
>+            	    mSafeTmpdir = strdup(path);
>+            	    break;
>+		}
>+	    } else {
>+        	if (mkdir(path, S_IRWXU) == 0) {
>+            	    mSafeTmpdir = strdup(path);
>+            	    break;
>+        	}
>+		if (errno != EEXIST) 
>+		    break; /* cant create */
>+	    }
>+	}
>+    }
>+    path[0] = '\0';
>+    if (mSafeTmpdir == NULL)
>+        return;
>+
>+    TemporaryFilenameHelper(path, mSafeTmpdir);
>+}
>+
>+static void TemporaryFilenameHelper(char *path, char *mSafeTmpdir)
>+{
> #define RandomKeyExtent  6
> 
>   char
>@@ -2670,24 +2728,9 @@
>     /*
>       Get temporary pathname.
>     */
>-    (void) strcpy(path,"magic");
>-#if defined(vms) || defined(macintosh)
>-    (void) tmpnam(path);
>-#else
>-    {
>-      char
>-        *name;
>+    (void) strcpy(path, mSafeTmpdir);
>+    strncat(path, "/magick", MaxTextExtent-strlen(path)-1); 
> 
>-      name=(char *) tempnam((char *) NULL,path);
>-      if (name == (char *) NULL)
>-        (void) tmpnam(path);
>-      else
>-        {
>-          (void) strncpy(path,name,MaxTextExtent-1);
>-          LiberateMemory((void **) &name);
>-        }
>-    }
>-#endif
>     /*
>       Add salt to strengthen weak tmpnam()/tempnam() implementations.
>     */

Actions: View

Attachments on bug 42865: 13080 | 13081 | 13085 | 13098 | 13115