vulnerability: rewrite arbitrary user file

[Vasily Kulikov]

Hi, I've just discovered that tesseract-ocr is vulnerable to rewriting any user file:

DEBUG_WIN::DEBUG_WIN( //constructor
...
  length +=
    sprintf (command + length,
    "\"stty opost; tty >/tmp/debug%d; while [ -s /tmp/debug%d ]\ndo\nsleep 1\ndone\" &\n",
    pid, pid);

Here attacker can create link to any file in the system that user may write to. The only he has to know - the pid of process. As it is (last PID + 1) by default, it is not difficult to guess.

Thanks.

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better.

The latest release of Ubuntu is not vulnerable to symlink race attacks, but earlier releases will need fixing. https://wiki.ubuntu.com/Security/Features#symlink

Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Launchpad Janitor (janitor)]

This bug was fixed in the package tesseract - 2.04-2.1

---------------
tesseract (2.04-2.1) unstable; urgency=low

  * Non-maintainer upload.
  * Bump build-dependency on quilt to >= 0.46-7~.
  * Disable xterm-based debug windows (closes: #612032, LP: #607297). Thanks
    to Kees Cook for the bug report.
 -- Bhavani Shankar <email address hidden> Thu, 10 Feb 2011 16:35:45 +0100