|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-0752: OpenOffice Insecure Temporary File Creation | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Ludwig Nussel <lnussel> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | pmladek, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-0752: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Ludwig Nussel
2004-08-20 18:38:06 UTC
I can confirm the behaviour and will look at it. The workaround would be to set the variable TEMP to any existing directory. For example, if it is set to TEMP=$HOME the temporary files looks like $HOME/sv7i0.tmp/sv7i2.tmp Very good :-) I'd vote for not pushing out an update for this monster package then but rather explain the workaround in an advisory. Judging from the mail cited above, setting the umask is another workaround. Someone who wants his files private should have 077 anyways. Hmm, I have made some more detailed investigation in the OOo sources. Unforunatelly, the temporary files/directories are not created only at one place. The temporary directory can by changed by the environment variables TEMP and TMP on almost all places. TEMP is usually preferred over TMP but in installation/setup2/mow/source/loader/loader.c TMP is preferred over TEMP. One exception is in gsl/psprint/source/printergfx/printerjob.cxx where only the variable TMPDIR can be used to change the temporary spool directory. Another exception is in porting/sal/osl/unx/signal.c where /tmp is hardcoded and cannot be changed at runtime. This path is used to complete informations for ReportCrash. So, in this case the informations about stack, ... are visible. There might be some other specific cases but they are related to the OOo build tools which are used only at the build time and are not packaged. I didn't investigate this parts. Another problem is that that the temporary directories and files are not created in a save way. First, an unique file name is created. Then the directory is created by mkdir. So, mktemp is not used. Result: 1. Environment variables TEMP, TMP, TMPDIR solves almost all situations except the one when data for ReportCrash are created. They solves also the problem with the insecure way of creating temporary files and directories. 2. umask solves the situation with ReportCrash. It does not help to solve the insecure way of creating files. It impacts also permissions of normal files created by OOo. So, some users would complain. Thanks for the Analysis. Can you fix the cases where sensitive information is stored word readable for STABLE? Wrt mkdir, mkdir fails if the directory already exists. So it's ok as long as the directory is not used when mkdir failed. It seems that mkdir is really used the safe way. BTW: The most problematic temporary directory where the actually edited documents are stored can be also changed in the OOo menu Tools/Options/OpenOffice.org/Paths/Temporary Files. Unfortunatelly, this temporary path does not affect the path used for printing spool and for crash report where /tmp is still used. Even this path is set to $HOME/OpenOffice.org/user/temp in OOo, version 1.0.x by default. So, the situation is better at SL 8.2 and former releases. OK, I'll fix it for STABLE. It's fixed in STABLE now (The Ximian's guys did the patch). I'll reassign the bug to the security team becase they will create an advisory for older releases. apparently the disclosure date for this was set to October 15 and it got leaked through our bugreport towards OpenOffice. We need to take care that such things don't happen ;) we mentioned this in an advisory, so close. (http://www.suse.de/de/security/2004_31_cups.html) CVE-2004-0752: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N) |