kpopper10.txt

`#########################################################  
  
kpopper insecure temporary file creation  
  
Vendor: http://kpopper.sourceforge.net/  
Advisory: http://www.zataz.net/adviso/kpopper-06152005.txt  
Vendor informed: yes  
Exploit available: yes  
Impact : low  
Exploitation : low  
  
#########################################################  
  
The vulnerability is caused due to temporary file being created insecurely.  
This can be exploited via symlink attacks in combination to create and   
overwrite arbitrary files with the privileges of the user running the   
affected script.  
  
##########  
Versions:  
##########  
  
kpopper <= 1.0  
  
##########  
Solution:  
##########  
  
To prevent symlink attack use kernel patch such as grsecurity  
  
#########  
Timeline:  
#########  
  
Discovered : 2005-06-13  
Vendor notified : 2005-06-15  
Vendor response : no reponse  
Vendor fix : no fix  
Vendor Sec report ([email protected]) : 2005-06-27  
Disclosure : 2005-07-04  
  
#####################  
Technical details :  
#####################  
  
Vulnerable code :  
-----------------  
  
popper/popper-send.sh  
  
#!/bin/sh  
echo "$2" > /tmp/.popper-new  
echo `date +"%a %l:%m %p"` >> /tmp/.popper-new  
cat "$1" >> /tmp/.popper-new  
mv -f /tmp/.popper-new /tmp/.popper  
  
The .popper is also used into :  
  
popper/popper.cpp  
  
#########  
Related :  
#########  
  
Bug report : http://bugs.gentoo.org/show_bug.cgi?id=94475  
CVE : CAN-2005-1917  
  
#####################  
Credits :  
#####################  
  
Eric Romang ([email protected] - ZATAZ Audit)  
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, etc.)  
`