################################################## #######

everybuddy insecure temporary file creation

Vendor: http://www.everybuddy.com/ (no more vendor URL)
Advisory: http://www.zataz.net/adviso/everybuddy-06062005.txt
Vendor informed: no more vendor
Exploit available: yes
Impact : low
Exploitation : low

################################################## #######

The vulnerability is caused due to temporary file being created =
insecurely.
This can be exploited via symlink attacks in combination to create and=20
overwrite
arbitrary files with the privileges of the user running the affected =
script.

##########
Versions:
##########

everybuddy <=3D 0.4.3

##########
Solution:
##########

Don't use this tool

#########
Timeline:
#########

Discovered : 2005-05-30
Vendor notified : no more vendor
Vendor response : no more vendor
Vendor fix : no fix
Disclosure : 2005-06-06

#####################
Technical details :
#####################

Vulnerable code :
-----------------

modules/utility/autotrans.c

258 g_snprintf(buf, 2048, "rm /tmp/.eb.%s.translator -f ; wget -O=20
/tmp/.eb.%s.translator=20
'http://world.altavista.com/sites/gben/pos/babelfish/tr?tt=3Durltext&lp=3D=
%s_%s&urltext=3D%s'",
259 getenv("USER"), getenv("USER"), from, to, string);
260
261 printf("Running command line:\n%s\n", buf);
262
263 if(system(buf)!=3D0)
264 {
265 printf("COULD NOT TRANSLATE: %s\n", ostring);
266 free(string);
267 return strdup(ostring);
268 }
269
270 g_snprintf(buf, 2048, "/tmp/.eb.%s.translator", getenv("USER"));
271
272 if((dat=3Dfopen(buf, "r"))=3D=3DNULL)
273 {
274 printf("COULD NOT TRANSLATE: %s\n", ostring);
275 free(string);
276 return strdup(ostring);
277 }
278
279 pos=3D0;
280
281 while(!feof(dat))
282 {
283 for(a=3D0; a<3; a++)
284 {
285 lastfew[a]=3Dlastfew[a+1];
286 }
287 lastfew[3]=3D(char)getc(dat);
288
289 if(printing>=3D1)
290 {
291 buf[pos++]=3Dlastfew[3];
292 if(pos=3D=3D1023) { buf[pos]=3D'\0'; break; }
293 }
294
295 if(!strcmp(lastfew, "</TE"))
296 {
297 printf("Found end\n");
298 if (pos >=3D 5) {
299 buf[pos-4]=3D'\0';
300 printing++;
301 while(pos>=3D5 && (buf[pos-5]=3D=3D'\n' || =
buf[pos-5]=3D=3D'\r'))
302 {
303 buf[pos-5]=3D'\0';
304 pos--;
305 }
306 }
307 break;
308 }

#########
Related :
#########

Gentoo Bugs report : http://bugs.gentoo.org/show_bug.cgi?id=3D94473

#####################
Credits :
#####################

Eric Romang (eromang@zataz.net - ZATAZ Audit)
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, tigger, etc.)

-------------------------------------------------------------------------=
---=20

This e-mail and any attached files are confidential and intended solely =
for the use of the individual or entity to whom they are addressed. If =
you have received this e-mail by mistake, please notify the sender =
immediately and delete it from your system. You must not copy the =
message or disclose its contents to anyone.

-------------------------------------------------------------------------=
---