5845603 2000-12-11 17:08 +0100 /154 rader/ <advisories@WKIT.COM> Sänt av: joel@lysator.liu.se Importerad: 2000-12-11 21:20 av Brevbäraren (som är implementerad i) Python Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM Externa svar till: advisories@WKIT.COM Mottagare: Bugtraq (import) <14152> Ärende: pico Text Editor Symbolic Link Vulnerability : ERROR CORRECTION ------------------------------------------------------------ From: advisories@WKIT.COM To: BUGTRAQ@SECURITYFOCUS.COM Message-ID: <OFEAEFD579.C05C2631-ONC12569B2.00586100@wkit.se> The previous submission stated that the vendor of pico is Washington University. This was an error. Of course it sould said University of Washington. The vendor we've for the vulnerability contacted was University of Washington. Below is the correct message. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: pico Text Editor Symbolic Link Vulnerability ADVISORY ID: WSIR-00/11-02 CVE: GENERIC-MAP-NOMATCH DISCOVERED BY: Christer Öberg, Wkit Security AB CONTACT: Patrik Birgersson, Wkit Security AB CLASS: Design Error OBJECT: pico(1) (exec) VENDOR: University of Washington STATUS: Vendor contacted on 15/11/00 without reply. REMOTE: No LOCAL: Yes DATE: 15/11/00 VULNERABLE: Pico 3.7 VULNERABILITY DESCRIPTION Upon abnormal exit, the text editor saves any changes made to the file being edited into a new file in the current working directory labeled filename.save (where filename will correspond to the name of the file being edited, e.g. test.txt will be saved as test.txt.save). When saving this file, the text editor does not check for the file type. A user editing a file in a directory writable by others could be subject to having other files written to if a malicious user were to symbollically link the filename.save file to one of owner/group write access of the user. This would result in the contents of the pico session being written to the symbolically linked file. CONDITIONS 1. The malicious user must have write permissions in the directory where the file is being edited, in order to create a link. 2. The 'victim user' must have write permissions for the 'victim file'. 3. The 'victim user' pico session must terminate abnormally. 4. The file being edited must not have been saved VULNERABILITY EXAMPLE ** Root is logged in remote ** Malicious user (foo) notices that root is editing file.txt in /tmp (where foo has write permissions) ** foo creates a link from /etc/passwd (root = write permission) to /tmp/filename.save ** Root's connection is dropped or terminated under abnormal conditions (for example: root halts the system) before file.txt is saved, the editor will write a rescue copy to /tmp/ filename.save ** The editor won't check if /tmp/ filename.save is a link, and overwrites /etc/passwd with the content of file.txt. SOLUTION/VENDOR INFORMATION/WORKAROUND No information available CREDITS This vulnerability was discovered and documented by Christer Öberg and Patrik Birgersson of Wkit Security AB, Håverud, Sweden. Other advisories from Wkit Security AB can be obtained from: http://www.wkit.com/advisories/ DISCLAMER The contents of this advisory is copyright (c) 2000 Wkit Security AB and may be distributed freely, provided that no fee is charged and proper credit is given. Wkit Security AB takes no credit for this discovery if someone else has published this information in the public domain before this advisory was released. The information herein is intended for educational purposes, not for malicious use. Wkit Security AB takes no responsibility whatsoever for the use of this information. ABOUT THE COMPANY Wkit Security AB is an independent data security company working with security-related services and products. Wkit Security AB plays a leading role in the development of security thinking, regarding internal and external data communication at companies and other organizations that store sensitive information. The company consists of two divisions: a service division, performing security analysis and security reviews, and a product division. We work together with strategic partners to bring programs and services into the market. Our services and products are continuously developed to optimally follow the world demand for IT security. 30 DAY DISCLOSURE Whenever Wkit Security AB finds any security related flaws in operating system, or application, we will provide the vendor responsible for the product with a detailed Incident Report. We believe that 30 days is appropriate for the vendor to fix the problem before we publish the incident report on our own web page and other mailing lists/websites we find suitable for the majority of the worldwide users. If the vendor has a reasonable cause why they can't fix the problem in 30 days we can, after discussion, agree on a longer disclosure time. ACKNOWLEDGEMENTS Wkit Security AB's highest priority is for the public security, and will never release Incidents Reports without informing the vendor and give them reasonable (30 day) time to fix the problem. In general, Wkit Security AB follows the guidelines for reporting security breaches we found on the vendors homepage or similar. We urge vendors that in the same way we follow their guidelines, that the vendor informs us about the solution; if possible, 2 days before the fix/solution will be presented for the majority. This gives us the chance to prepare our web page to inform about the Incident and to present a solution in the way the vendor suggest at the time when it is present for the majority. CONTACT Wkit Security AB should be contacted through advisories@wkit.com if no other agreement has been done. Every incident report is assigned a report number WSIR-xx/xx-xx (Wkit Security AB Incident Report) and one responsible contact person from Wkit Security. When communicating with Wkit Security AB in the matter of the Incident Reports, be sure to add the WSIR number in the email to avoid any problems. *************************************************************************** Wkit Security AB Upperudsvägen 4 S-464 72 Håverud SWEDEN http://www.wkit.com e-mail: advisories@wkit.com *************************************************************************** -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQA/AwUBOjT68QFyk+p4kGd0EQL7zwCeMyewdRZ4Ugt9tGtf+l72lear9cUAn10r sn/qAdJoabUactvzuvbsv7iM =gRCG -----END PGP SIGNATURE----- (5845603) --------------------------------(Ombruten)