newsTiger UNIX security tool - News: WARNING: Security vulnerability discovered in Tiger's realpath

 
 
Latest News
Tiger 3.2.3 released: bug fix release posted by jfs, Wed Sep 10 07:44:18 2008 - 0 replies
Offline audit scripts now available posted by jfs, Mon Aug 27 19:31:52 2007 - 0 replies
New 3.2.2 release posted by jfs, Mon Aug 27 19:22:59 2007 - 0 replies
Download of releases (temporary) posted by jfs, Tue Apr 27 18:57:49 2004 - 0 replies

WARNING: Security vulnerability discovered in Tiger's realpath

Item posted by Javier Fernandez-Sanguino Peña <jfs> on Fri May 9 18:38:01 2003.

A security vulnerability has been detected by Steve Grub [1] in the c/realpath.c program which is distributed in all Tiger versions. The realpath function used did not proper limit the input to it which could cause a buffer overflow.

In some operating systems it might be possible to crash realpath if the filesystem has a file which is checked by the Tiger scripts and has an overlong filepath. A malicious local user might create such a path by creating recursive directories in a directory where he has write access and wait for a cron job to access it. It's not clear, however, if it would be directly exploitable (the name of the file which overflows the buffer would need to include characters which may not be permitted in the underlying file system)

Realpath is used by some of Tiger checks including:
- the 'find_files' check which calls sub/check_link. This check will run if Tiger_Check_Filesystem is set to 'Y'.

- the 'check_aliases' check

- the 'check_cron' check

- the 'check_inetd' check

- the 'check_path' check

- the 'check_printcap' check

The only one of these checks that will browse the full filesystem is 'find_files', other checks' use of realpath is limited to the local system configuration. Users who cannot patch Tiger (see below) have to consider disabling temporarily this check from the configuration files tigerrc and cronrc. Notice, that this check is run by default from Tiger's cron setup once a month.

A patch for the current unstable version (from 3.0 to 3.2rc3) has been provided and is available from the CVS sources: http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/c/realpath.c.diff?r1=1.1&r2=1.2
Also, a patch for older versions (2.2.4) has been made available: http://savannah.nongnu.org/download/tiger/stable.pkg/2.2.4/tiger-2.2.4p1-patch2

I would like to thank Steve Grub for reporting this issue.

Javier Fernandez-Sanguino

[1] http://mail.gnu.org/archive/html/tiger-devel/2003-04/msg00001.html

Comments:

No messages in WARNING: Security vulnerability discovered in Tiger's realpath

 

Back to the top


Powered by Savane 3.1-cleanup