newsTiger UNIX security tool - News: WARNING: Security vulnerability discovered in Tiger's realpath

 
 
Latest News
Tiger 3.2.3 released: bug fix release posted by jfs, Wed 10 Sep 2008 07:44:18 AM UTC
Offline audit scripts now available posted by jfs, Mon 27 Aug 2007 07:31:52 PM UTC
New 3.2.2 release posted by jfs, Mon 27 Aug 2007 07:22:59 PM UTC
Download of releases (temporary) posted by jfs, Tue 27 Apr 2004 06:57:49 PM UTC
Important note related to Savannah compromise posted by jfs, Thu 08 Jan 2004 10:51:45 AM UTC

WARNING: Security vulnerability discovered in Tiger's realpath

Item posted by Javier Fernandez-Sanguino Peña <jfs> on Fri 09 May 2003 06:38:01 PM UTC.

A security vulnerability has been detected by Steve Grub [1] in the c/realpath.c program which is distributed in all Tiger versions. The realpath function used did not proper limit the input to it which could cause a buffer overflow.

In some operating systems it might be possible to crash realpath if the filesystem has a file which is checked by the Tiger scripts and has an overlong filepath. A malicious local user might create such a path by creating recursive directories in a directory where he has write access and wait for a cron job to access it. It's not clear, however, if it would be directly exploitable (the name of the file which overflows the buffer would need to include characters which may not be permitted in the underlying file system)

Realpath is used by some of Tiger checks including:
- the 'find_files' check which calls sub/check_link. This check will run if Tiger_Check_Filesystem is set to 'Y'.

- the 'check_aliases' check

- the 'check_cron' check

- the 'check_inetd' check

- the 'check_path' check

- the 'check_printcap' check

The only one of these checks that will browse the full filesystem is 'find_files', other checks' use of realpath is limited to the local system configuration.  Users who cannot patch Tiger (see below) have to consider disabling temporarily this check from the configuration files tigerrc and cronrc. Notice, that this check is run by default from Tiger's cron setup once a month.

A patch for the current unstable version (from 3.0 to 3.2rc3) has been provided and is available from the CVS sources: http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/c/realpath.c.diff?r1=1.1&r2=1.2
Also, a patch for older versions (2.2.4) has been made available: http://savannah.nongnu.org/download/tiger/stable.pkg/2.2.4/tiger-2.2.4p1-patch2

I would like to thank Steve Grub for reporting this issue.

Javier Fernandez-Sanguino

[1] http://mail.gnu.org/archive/html/tiger-devel/2003-04/msg00001.html

 

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code