mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-31 00:39:46 +00:00
Code Issues Projects Releases Wiki Activity

Screen: fix for Security Advisory CVE-2009-1214

Browse Source 
GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with
world-readable permissions, which might allow local users to obtain
sensitive session information.

(From OE-Core rev: 25a212d0154906e7a05075d015dbc1cfdfabb73a)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Yue Tao
2014-04-14 12:41:17 +08:00
committed by Richard Purdie
parent 901a28b661
commit 27aba0a8d9
2 changed files with 87 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-extended/screen/screen-4.0.3/screen-4.0.3-CVE-2009-1214.patch
+86
View File
@@ -0,0 +1,86 @@
Upstream-Status: Backport
The patch to fix CVE-2009-1214
A security flaw was found in the screen utility in the way it used to create
one particular temporary file. An attacker could use this flaw to perform
a symlink attack.
Fix race condition creating temporary file
Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=492104
Signed-off-by: Chenyang Guo <chenyang.guo@windriver.com>
---
fileio.c | 48 ++++++++++++++++++++++++++++++++----------------
1 file changed, 32 insertions(+), 16 deletions(-)
--- a/fileio.c
+++ b/fileio.c
@@ -414,6 +414,14 @@ int dump;
}
public = !strcmp(fn, DEFAULT_BUFFERFILE);
# ifdef HAVE_LSTAT
+ /*
+ * Note: In the time between lstat() and open()/remove() below are
+ * called, the file can be created/removed/modified. Therefore the
+ * information lstat() returns is taken into consideration, but not
+ * relied upon. In particular, the open()/remove() calls can fail, and
+ * the code must account for that. Symlink attack could be mounted if
+ * the code is changed carelessly. --rdancer 2009-01-11
+ */
exists = !lstat(fn, &stb);
if (public && exists && (S_ISLNK(stb.st_mode) || stb.st_nlink > 1))
{
@@ -432,28 +440,36 @@ int dump;
#ifdef COPY_PASTE
if (dump == DUMP_EXCHANGE && public)
{
+ /*
+ * Setting umask to zero is a bad idea -- the user surely doesn't
+ * expect a publicly readable file in a publicly readable directory
+ * --rdancer 2009-01-11
+ */
+ /*
old_umask = umask(0);
+ */
# ifdef HAVE_LSTAT
if (exists)
- {
- if ((fd = open(fn, O_WRONLY, 0666)) >= 0)
- {
- if (fstat(fd, &stb2) == 0 && stb.st_dev == stb2.st_dev && stb.st_ino == stb2.st_ino)
- ftruncate(fd, 0);
- else
- {
- close(fd);
- fd = -1;
- }
- }
- }
- else
- fd = open(fn, O_WRONLY|O_CREAT|O_EXCL, 0666);
- f = fd >= 0 ? fdopen(fd, mode) : 0;
+ if (remove(fn) == -1)
+ {
+ /* Error */
+ debug2("WriteFile: File exists and remove(%s) failed: %s\n",
+ fn, strerror(errno));
+ UserReturn(0);
+ }
# else
- f = fopen(fn, mode);
+ (void) remove(fn);
# endif
+ /*
+ * No r/w permissions for anybody but the user, as the file may be in
+ * a public directory -- if the user chooses, they can chmod the file
+ * afterwards. --rdancer 2008-01-11
+ */
+ fd = open(fn, O_WRONLY|O_CREAT|O_EXCL, 0600);
+ f = fd >= 0 ? fdopen(fd, mode) : 0;
+ /*
umask(old_umask);
+ */
}
else
#endif /* COPY_PASTE */
meta/recipes-extended/screen/screen_4.0.3.bb
+1
View File
@@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/screen/screen-${PV}.tar.gz;name=tarball \
${DEBIAN_MIRROR}/main/s/screen/screen_4.0.3-14.diff.gz;name=patch \ ${DEBIAN_MIRROR}/main/s/screen/screen_4.0.3-14.diff.gz;name=patch \
file://configure.patch \ file://configure.patch \
file://fix-parallel-make.patch \ file://fix-parallel-make.patch \
file://screen-4.0.3-CVE-2009-1214.patch \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)}" ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)}"
PAM_SRC_URI = "file://screen.pam" PAM_SRC_URI = "file://screen.pam"