Onderwerp: [SuSE 9.0] possible symlink attacks in some scripts

Product: some scripts shipped with suse 9.0
Date: 20.01.2004
Author: l0om <l0om@excluded.org>

greetings,
i have done a litte reseach on a SuSE linux 9.0 box
for possible symlink attacks. i have checked nearly
every script i could found on the system. i havent
found much and nothing very special.i dont have a
clue if the following scripts are somewhere on the
system executed but maybe someone useses them in a
script or something like that.


**
/usr/X11R6/bin/fvwm-bug
[...]
TEMP=/tmp/fvwm-bug.$$
[...]
cat > $TEMP <<EOF
[...]

**
/usr/X11R6/bin/wm-oldmenu2new
[...]
T=/tmp/wmmenu$$
[...]
cp $OLD_MENU $T-c
[...]

**
/usr/X11R6/bin/x11perfcomp
[...]
tmp=${TMPDIR-/tmp}/rates.$$
mkdir $tmp || exit 1
[...]
mkdir $tmp/rates
[...]
-l) cp $2 $tmp/labels
[...]
rm -rf $tmp
[...]

**
/usr/X11R6/bin/xf86debug
[...]
gdb << EOF &> /tmp/xf86debug.1.log
echo "Debugger output written to /tmp/
xf86debug.1.log." #thx for that info
[...]

**
/opt/kde3/bin/winpopup-send.sh
echo "$2" > /tmp/.winpopup-new
echo `date +"%a %l:%m %p"` >> /tmp/.winpopup-new
cat "$1" | tr "\000" "\012" >> /tmp/.winpopup-new
mv -f /tmp/.winpopup-new /tmp/.winpopup

**
/sbin/lvmcreate_initrd
[...]
DEVRAM=/tmp/initrd.$$
[...]
verbose "using $DEVRAM as a temporary loopback file"
#thx for that info
dd if=/dev/zero of=$DEVRAM count=$INITRDSIZE bs=1024
> /dev/null 2>&1
[...]

********** greets @ proxy, takt, maximilian, sirius,
dna, fe2k, xnet, zexl
rest of excluded.org
nofx, rancid, bad religion, less
than jake ...
www.excluded.org --l0om
have Phun!

>greetings,

Hello.

>i have done a litte reseach on a SuSE linux 9.0 box
>for possible symlink attacks. i have checked nearly
>every script i could found on the system. i havent
>found much and nothing very special.

Good.


>i dont have a
>clue if the following scripts are somewhere on the
>system executed but maybe someone useses them in a
>script or something like that.

We will fix the bugs you found, but it's always nicer
to contact us before you go public with bug-reports.
Just write an eMail to security@suse.de and you will
get an answer after a few hours or less.


Bye,
Thomas
--
Thomas Biege <thomas@suse.de>, SUSE LINUX AG, Security Support & Auditing
--
# If you have the "driftnet" program installed, webcollage can display a
# collage of images sniffed off your local ethernet, instead of pulled out
# of search engines: in that way, your screensaver can display the images
# that your co-workers are downloading!
-- xscreensaver source-code

>greetings,

Hello.

>i have done a litte reseach on a SuSE linux 9.0 box
>for possible symlink attacks. i have checked nearly
>every script i could found on the system. i havent
>found much and nothing very special.

Good.


>i dont have a
>clue if the following scripts are somewhere on the
>system executed but maybe someone useses them in a
>script or something like that.

We will fix the bugs you found, but it's always nicer
to contact us before you go public with bug-reports.
Just write an eMail to security@suse.de and you will
get an answer after a few hours or less.


Bye,
Thomas
--
Thomas Biege <thomas@suse.de>, SUSE LINUX AG, Security Support & Auditing
--
# If you have the "driftnet" program installed, webcollage can display a
# collage of images sniffed off your local ethernet, instead of pulled out
# of search engines: in that way, your screensaver can display the images
# that your co-workers are downloading!
-- xscreensaver source-code