[CVE-2008-4406/4407] - Sabre - local users to cause a denial of service andlocal users to delete or overwrite arbitrary files via a symlink attack

[Stefan Lesicnik]

Binary package hint: sabre

A certain Debian patch to the run scripts for sabre (aka xsabre) 0.2.4b
allows local users to delete or overwrite arbitrary files via a symlink
attack on unspecified .tmp files.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4406

XRunSabre in sabre (aka xsabre) 0.2.4b relies on the ability to create
/tmp/sabre.log, which allows local users to cause a denial of service
(application unavailability) by creating a /tmp/sabre.log file that cannot
be overwritten.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4407

[Stefan Lesicnik (stefanlsd)]

Two separate CVE issues exist both with regards to the creation of .tmp files.

The first is a local users denial of service, where one user starts the application and the file is created and not removed. Subsequent different users cannot start the application as this file exists and cannot be removed.

The second is a symlink attack to possibly delete or overwrite arbitrary files.

cat /etc/fstab
##UNCONFIGURED BASE SYSTEM
ln -s /etc/fstab /tmp/sabre.log

cat /etc/fstab
Not running in a graphics capable console,
and unable to find one.

The upstream provided patch uses mktemp to generate random temporary files.

[Stefan Lesicnik (stefanlsd)]

Gutsy & Hardy use the same version.

Testing with Hardy chroot we can now see sabre uses real temp files

-rw------- 1 root root 67 Oct 15 19:52 sabre.H26051
-rw------- 1 root root 0 Oct 15 19:52 sabre.U26052
-rw------- 1 root root 3 Oct 15 19:52 sabre.h26050

After exiting all log files are successfully deleted.

[Jamie Strandboge (jdstrand)]

Thanks Stefan! The gutsy and hardy debdiffs are malformed. Can you clean them up, test, upload and mark the bug back to In Progress?

[Stefan Lesicnik (stefanlsd)]

Sorry for the inconvenience. Created patches with quilt, built and tested. Should hopefully be better.