Predictable /tmp filenames used in SourcesHandler

[Clint Byrum]

The use of /tmp without randomization in filename is a generally bad security practice. If the host has a non-root malicious user present they can use a local DNS cache poison and predict these filenames and create their own symlink to a root owned file such as /etc/shadow, thus gaining root access. This is a theoretical vulnerability.

[Clint Byrum (clint-fewbar)]

Attaching a patch, instead of using gerrit, until it is deemed safe to make this bug report public.

[Steve Baker (steve-stevebaker)]

Patch applied and test ran locally.

[Thierry Carrez (ttx)]

heat-cfntools (or Heat/Grizzly) are not covered by the vulnerability management policy yet, so feel free to release this in your preferred way, as we won't be releasing an official OSSA (openstack security advisory) for it.

My suggestion would be to send a message to the openstack general ML once the patch makes it to the repo. Alternatively you can ask for a CVE and try to coordinate fixes with affected distros, if any.

[Clint Byrum (clint-fewbar)]

Excerpts from Thierry Carrez's message of 2013-04-09 08:38:08 UTC:
> heat-cfntools (or Heat/Grizzly) are not covered by the vulnerability
> management policy yet, so feel free to release this in your preferred
> way, as we won't be releasing an official OSSA (openstack security
> advisory) for it.
>
> My suggestion would be to send a message to the openstack general ML
> once the patch makes it to the repo. Alternatively you can ask for a CVE
> and try to coordinate fixes with affected distros, if any.
>

Thanks Thierry! We'll figure it out, soon I hope. :)

[Steve Baker (steve-stevebaker)]

I'm testing this on a running instance, I'm getting this in the log:
DEBUG [2013-04-10 00:16:25,669] Running command: wget -O /tmp/tmpsonobf/StarCluster-master.tar.gz https://github.com/mza/StarCluster/tarball/master
DEBUG [2013-04-10 00:16:34,465] Running command: tar -C /home/ec2-user/starcluster -xzf /tmp/tmpsonobf/StarCluster-master.tar.gz
DEBUG [2013-04-10 00:16:36,527] Return code of 2 after executing: '['su', 'root', '-c', u'tar -C /home/ec2-user/starcluster -xzf /tmp/tmpsonobf/StarCluster-master.tar.gz']'

and /home/ec2-user/starcluster exists but is empty.

Running the tar command manually results in /home/ec2-user/starcluster being populated.

What is needed here? running sync after wget?

[Steve Baker (steve-stevebaker)]

Sync after wget didn't help.