This is the mail archive of the
cygwin-xfree@cygwin.com
mailing list for the Cygwin XFree86 project.
Logfile symlink vulnerability
- From: Eran Tromer <cygwinx2eran2eran at tromer dot org>
- To: cygwin-xfree at cygwin dot com
- Date: Sun, 21 Mar 2004 20:50:51 +0200
- Subject: Logfile symlink vulnerability
- Reply-to: cygwin-xfree at cygwin dot com
Hi,
If /tmp/XWin.log is a symlink, XWin will merrily follow it and write to
whatever it's pointing to (see LogInit() in os/log.c). This allows
standard symlink-following attacks.
Example: Alice runs "ln -s /home/Bob/phd-thesis.tex /tmp/XWin.log" under
her account. Later Bob runs XWin under his account; XWin fails for some
reasons and writes to /tmp/XWin.log; Bob life's work gets overwritten.
(Of course, that's interesting only if ntsec is used.)
Some possible fixes:
* Place the logfile somewhere in the user's home directory.
* Refuse to follow symlinks, or to write to existing files. Most users,
failing to clean up logs, will not get new logs after the first failure.
* Give the logfile a unique filename, a la the "uniq" utility.
Eran