Tiger UNIX security tool - News

Group

Main
- Main
- View members
- Search
Homepage
Download
Support
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Mailing lists
Source code
Bugs
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Tasks
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Patches
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
News
- Browse
- Atom feed
- ~~Submit~~
- ~~Manage~~

WARNING: Security vulnerability discovered in Tiger's realpath

Item posted by Javier Fernandez-Sanguino Peña <jfs> on Fri 09 May 2003 06:38:01 PM UTC.

A security vulnerability has been detected by Steve Grub [1] in the c/realpath.c program which is distributed in all Tiger versions. The realpath function used did not proper limit the input to it which could cause a buffer overflow.

In some operating systems it might be possible to crash realpath if the filesystem has a file which is checked by the Tiger scripts and has an overlong filepath. A malicious local user might create such a path by creating recursive directories in a directory where he has write access and wait for a cron job to access it. It's not clear, however, if it would be directly exploitable (the name of the file which overflows the buffer would need to include characters which may not be permitted in the underlying file system)

Realpath is used by some of Tiger checks including:
- the 'find_files' check which calls sub/check_link. This check will run if Tiger_Check_Filesystem is set to 'Y'.

- the 'check_aliases' check

- the 'check_cron' check

- the 'check_inetd' check

- the 'check_path' check

- the 'check_printcap' check

The only one of these checks that will browse the full filesystem is 'find_files', other checks' use of realpath is limited to the local system configuration. Users who cannot patch Tiger (see below) have to consider disabling temporarily this check from the configuration files tigerrc and cronrc. Notice, that this check is run by default from Tiger's cron setup once a month.

A patch for the current unstable version (from 3.0 to 3.2rc3) has been provided and is available from the CVS sources: http://savannah.nongnu.org/cgi-bin/viewcvs/tiger/tiger/c/realpath.c.diff?r1=1.1&r2=1.2
Also, a patch for older versions (2.2.4) has been made available: http://savannah.nongnu.org/download/tiger/stable.pkg/2.2.4/tiger-2.2.4p1-patch2

I would like to thank Steve Grub for reporting this issue.

Javier Fernandez-Sanguino

[1] http://mail.gnu.org/archive/html/tiger-devel/2003-04/msg00001.html