From owner-freebsd-security Tue Jul 15 09:47:43 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id JAA09574 for security-outgoing; Tue, 15 Jul 1997 09:47:43 -0700 (PDT) Received: from passer.osg.gov.bc.ca (passer.osg.gov.bc.ca [142.32.110.29]) by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id JAA09568 for ; Tue, 15 Jul 1997 09:47:39 -0700 (PDT) Received: from localhost (cschuber@localhost) by passer.osg.gov.bc.ca (8.8.5/8.6.10) with SMTP id JAA08215 for ; Tue, 15 Jul 1997 09:47:24 -0700 (PDT) Message-Id: <199707151647.JAA08215@passer.osg.gov.bc.ca> X-Authentication-Warning: passer.osg.gov.bc.ca: cschuber@localhost didn't use HELO protocol Reply-to: cschuber@uumail.gov.bc.ca X-Mailer: MH X-Sender: cschuber To: freebsd-security@freebsd.org Subject: CERT Vendor-Initiated Bulletin VB-97.05 - Vul in Lynx Temporary Files Date: Tue, 15 Jul 1997 09:47:23 -0700 From: Cy Schubert - ITSD Open Systems Group Sender: owner-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk This is for those of you who have installed the Lynx port. Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 UNIX Support OV/VM: BCSC02(CSCHUBER) ITSD BITNET: CSCHUBER@BCSC02.BITNET Government of BC Internet: cschuber@uumail.gov.bc.ca cschuber@bcsc02.gov.bc.ca "Quit spooling around, JES do it." ------- Forwarded Message Return-Path: cert_mailer@cert.org Received: (from uucp@localhost) by passer.osg.gov.bc.ca (8.8.5/8.6.10) id IAA07727 for ; Tue, 15 Jul 1997 08:10:52 -0700 (PDT) Received: from orca.gov.bc.ca(142.32.102.25) via SMTP by passer.osg.gov.bc.ca, id smtpdAAAaahrka; Tue Jul 15 08:10:47 1997 Received: from coal.cert.org by orca.gov.bc.ca (5.4R3.10/200.1.1.4) id AA06824; Tue, 15 Jul 1997 08:10:45 -0700 Received: (from cert-advisory@localhost) by coal.cert.org (8.6.12/CERT) id KAA20123 for cert-advisory-queue-5; Tue, 15 Jul 1997 10:50:45 -0400 Date: Tue, 15 Jul 1997 10:50:45 -0400 Message-Id: <199707151450.KAA20123@coal.cert.org> From: CERT Bulletin To: cert-advisory@cert.org Subject: CERT Vendor-Initiated Bulletin VB-97.05 - Vul in Lynx Temporary Files Reply-To: cert-advisory-request@cert.org Organization: CERT(sm) Coordination Center - +1 412-268-7090 - -----BEGIN PGP SIGNED MESSAGE----- ============================================================================= CERT* Vendor-Initiated Bulletin VB-97.05 July 15, 1997 Topic: Vulnerability in Lynx Temporary Files Source: Jim Spath To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Jim Spath, who coordinated this bulletin with several members of the lynx-dev mailing list. They urge you to act on this information as soon as possible. information is included in the forwarded text below; please contact them if you have any questions or need further information. Questions about the bulletin only can be sent to Jim Spath ; questions about Lynx can be sent to . =======================FORWARDED TEXT STARTS HERE============================ I. Description Lynx typically stores persistent temporary files in /tmp on Un*x systems. The filenames Lynx chooses can be predicted, and another user on the system may be able to exploit a race condition to replace the temporary file with a symbolic link or with another file. Installed versions of Lynx where a directory writeable by other users (such as /tmp on a machine to which multiple users have access) is used to store files during download are vulnerable. This vulnerability can only be exploited by a user with access to an account on the machine running Lynx. II. Impact A malicious user with access to the same machine as other Lynx users may be able to cause another user's Lynx process to overwrite another file. It may also be possible to replace the contents of a downloaded file with a file other than the one the user downloaded, or to cause the user to print a file other than the one selected for printing. III. Workarounds A workaround for Lynx 2.7.1 is described in the "solutions" section below. IV. Solutions There are several ways to solve this problem. A. The best solution to the problem is to apply the FOTEMODS patch set and to ensure that /tmp/ on your system is a "sticky directory." If you cannot apply this patch set, if your system does not support sticky directories, or if you cannot make /tmp/ a sticky directory, you must use one of the other solutions below. B. The other solution to this problem is to change the setting of TEMP_SPACE from the default ("/tmp/") to non-world-writeable directories. To do this with unpatched Lynx version 2.7.1: 1. Lynx can be rebuilt with the "#define TEMP_SPACE" in lynx2-7-1/userdefs.h changed from "/tmp" to point to a directory only writeable by the user executing Lynx. 2. The LYNX_TEMP_SPACE environment variable may be set before shell startup files (.profile, .cshrc, or equivalent) or into the system profile (/etc/profile or equivalent). As an aid to allowing Lynx to find user-specific temp. directories, Lynx 2.7.1 will replace "~" in the temp. space allocation with the path to the user's home directory. Individual users may also set the LYNX_TEMP_SPACE environment variable to point to another place known to be unwriteable by other users (for instance a subdirectory of the users' home directory, or a mode 0700 directory of a "sticky" /tmp). To do this with Lynx 2.7.1 with the FOTEMODS patch set applied: You may use any of the methods listed for "vanilla" Lynx 2.7.1. You may also use "$USER" in TEMP_SPACE (or $LYNX_TEMP_SPACE) to specify user-specific temp. directories such as /tmp/$USER/. The FOTEMODS patch set includes the changes described above as well as other fixes and feature enhancements. It can be found at: http://www.slcc.edu/lynx/fote/patches/ The FOTEMODS patches avoid any pre-existing filenames for new temporary files, thus skipping any symbolic link which may have been created with an upcoming temporary filename. These patches also allow the administrator or user to define TEMP_SPACE (or the LYNX_TEMP_SPACE environment variable) as "/tmp/$USER" (for example) for pre-existing directories that correspond to accounts' usernames and have protections/ACLs set for access only by the appropriate users. This patch set also does chmod(600) for temporary files which Lynx creates, but the account should be set up with an equivalent umask before invoking Lynx. C. One other solution (a source code patch) for this problem, by Klaus Weide, can be found at: http://www.slcc.edu/lynx/klaus/temp/ However, this patch should be considered "alpha" quality code, and its author is not supporting it at this time. The next release of Lynx will eliminate this vulnerability. Interested parties should subscribe to and read the LYNX-DEV mailing list (send mail to majordomo@sig.net with "subscribe lynx-dev" as the body) for information about this release. V. Contact information If you believe you have found a security problem with the current version of Lynx, we urge you to forward it to the LYNX-DEV mailing list at . The LYNX-DEV mailing list (with further information about this vulnerability) is archived at: http://www.flora.org/lynx-dev/ Lynx security information is available at: http://www.crl.com/~subir/lynx/security.html General information about Lynx is available at: http://lynx.browser.org/ On-line help and documentation about Lynx is available using the (h)elp command. More help is available in the source distribution. Should your questions not be answered by these means, further questions may be directed to . Please don't contact Lynx developers personally about Lynx-related issues; please use either the mailing list or the "help" addresses given above. ========================FORWARDED TEXT ENDS HERE============================= If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). See http://www.first.org/team-info/. We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information. Location of CERT PGP key ftp://info.cert.org/pub/CERT_PGP.key CERT Contact Information - - ------------------------ Email cert@cert.org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST (GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA CERT publications, information about FIRST representatives, and other security-related information are available from http://www.cert.org/ ftp://info.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for CERT advisories and bulletins, send your email address to cert-advisory-request@cert.org In the subject line, type SUBSCRIBE your-email-address * Registered U.S. Patent and Trademark Office. The CERT Coordination Center is part of the Software Engineering Institute (SEI). The SEI is sponsored by the U. S. Department of Defense. This file: ftp://info.cert.org/pub/cert_bulletins/VB-97.05.lynx - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBM8qS6nVP+x0t4w7BAQFOYQP/TMhu9GTxPTLGalOBpV3JLmzaQ1IgTPsr T9SbI4Oa+x+ALF1Y4Hr4gHmkI0OnWZiK2uPOXyGwpnswnSA4JutXQ8wbj5EyrTDr pnfCdzrxhalhc52BGOpfZFVjZp4lfoXc+jy8Y+cWG69UoHley9U1cnLLvcHL2dqs nBO3FUe/1k4= =ikIU - -----END PGP SIGNATURE----- ------- End of Forwarded Message