Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution
1. Summary
Product : Vim -- Vi IMproved
Versions : 5.0--current, possibly older; 4.6 and 3.0 not vulnerable
Impact : Arbitrary code execution
Wherefrom: Local
Original : http://www.rdancer.org/vulnerablevim-configure.in.html
http://www.rdancer.org/vulnerablevim-configure.in.patch
Insecure temporary file creation during the build process is vulnerable
to symbolic link attacks, and arbitrary code execution. Patch provided.
2. Background
``Vim is an almost compatible version of the UNIX editor Vi. Many new
features have been added: multi-level undo, syntax highlighting, command
line history, on-line help, spell checking, filename completion, block
operations, etc.''
-- VIM ``README.txt''
3. Vulnerability
During the build process, a temporary file with a predictable name is
created in the ``/tmp'' directory. This code is run when Vim is being
build with Python support:
src/configure.in:
677 dnl -- we need to examine Python's config/Makefile too
678 dnl see what the interpreter is built from
679 AC_CACHE_VAL(vi_cv_path_python_plibs,
680 [
681 tmp_mkf="/tmp/Makefile-conf$$"
(1)--> 682 cat ${PYTHON_CONFDIR}/Makefile - <<'eof' >${tmp_mkf}
683 __:
684 @echo "python_MODLIBS='$(MODLIBS)'"
685 @echo "python_LIBS='$(LIBS)'"
686 @echo "python_SYSLIBS='$(SYSLIBS)'"
687 @echo "python_LINKFORSHARED='$(LINKFORSHARED)'"
688 eof
689 dnl -- delete the lines from make about
Entering/Leaving directory
(2)--> 690 eval "`cd ${PYTHON_CONFDIR} && make -f
${tmp_mkf} __ | sed '/ directory /d'`"
691 rm -f ${tmp_mkf}
The attacker has to create the temporary file
``/tmp/Makefile-conf<PID>'' before it is first written to at (1). In
the time between (1) and (2), arbitrary commands can be written to the
file. They will be executed at (2).
3. Test Case
No test case.
4. Patch
Patch fixing this vulnerability can be found at the following URL:
http://www.rdancer.org/vulnerablevim-configure.in.patch
Please note: The patch fixes ``src/configure.in'', an input file used by
the ``autoconf'' command. ``autoconf'' uses this input file to create
``src/auto/configure''. It is necessary to remove the latter, if
present, to force its recreation. Otherwise, further build runs will
still use it, and the vulnerability will still be present.
5. Copyright
This advisory is Copyright 2008 Jan Minar <rdancer@xxxxxxxxxxx>
Copying welcome, under the Creative Commons ``Attribution-Share Alike''
License http://creativecommons.org/licenses/by-sa/2.0/uk/
Code included herein, and accompanying this advisory, may be copied
according to the GNU General Public License version 2, or the Vim
license. See the subdirectory ``licenses''.
Various portions of the accompanying code were written by various
parties. Those parties may hold copyright, and those portions may be
copied according to their respective licenses.
6. History
2008-07-17 Sent to: <bugs@xxxxxxx>, <vim-dev@xxxxxxx>
<full-disclosure@xxxxxxxxxxxxxxxxx>, <bugtraq@xxxxxxxxxxxxxxxxx>
--- - 2008-07-17 22:21:13.599801352 +0100
+++ src/configure.in 2008-07-17 22:21:03.000000000 +0100
@@ -678,8 +678,12 @@
dnl see what the interpreter is built from
AC_CACHE_VAL(vi_cv_path_python_plibs,
[
- tmp_mkf="/tmp/Makefile-conf$$"
- cat ${PYTHON_CONFDIR}/Makefile - <<'eof' >${tmp_mkf}
+ tmp_mkf="`mktemp`"
+ if test $? -ne 0 || ! test -f "${tmp_mkf}"; then
+ echo "Error: Can't create temporary file. Aborting."
+ exit 1
+ fi
+ cat -- "${PYTHON_CONFDIR}/Makefile" - <<'eof' >"${tmp_mkf}"
__:
@echo "python_MODLIBS='$(MODLIBS)'"
@echo "python_LIBS='$(LIBS)'"
@@ -687,8 +691,8 @@
@echo "python_LINKFORSHARED='$(LINKFORSHARED)'"
eof
dnl -- delete the lines from make about Entering/Leaving directory
- eval "`cd ${PYTHON_CONFDIR} && make -f ${tmp_mkf} __ | sed '/
directory /d'`"
- rm -f ${tmp_mkf}
+ eval "`cd ${PYTHON_CONFDIR} && make -f "${tmp_mkf}" __ | sed '/
directory /d'`"
+ rm -f -- "${tmp_mkf}"
if test "x$MACOSX" = "xyes" && ${vi_cv_path_python} -c \
"import sys; sys.exit(${vi_cv_var_python_version} < 2.3)"; then
vi_cv_path_python_plibs="-framework Python"