SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   XBoard Vendors:   GNU [multiple authors]
XBoard Unsafe Temporary Files May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1008375
SecurityTracker URL:  http://securitytracker.com/id/1008375
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 4 2003
Impact:   Modification of system information, Modification of user information, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.2.6 and prior versions
Description:   A vulnerability was reported in the XBoard chessboard graphical interface in the 'pxboard' script. A local user may be able to gain elevated privileges

It is reported that pxboard creates temporary files in an unsafe manner in the '/tmp' directory. A local user can create a symbolic link (symlink) from a critical file on the system to a temporary file to be used by pxboard. Then, when pxboard is executed by a target user, the symlinked file will be created or overwritten with the privileges of the target user.

According to the report, pxboard is not used by default and is only used when explicitly called.

Impact:   A local user can create or modify a file with the privileges of the user running XBoard.
Solution:   A fixed version (4.2.7) is available at:

http://ftp.gnu.org/gnu/xboard/xboard-4.2.7.tar.gz

Vendor URL:  www.tim-mann.org/xboard.html (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  XBoard < 4.2.7: pxboard insecure tmp file handling


About XBoard:

XBoard is a graphical chessboard that can serve as a user interface
to chess engines (such as GNU Chess), the Internet  Chess Servers,
electronic  mail  correspondence  chess,  or  your own collection of
saved games. pxboard is a script that saves its standard input to
a temporary file and invokes "xboard -loadGameFile file &" on the
file. pxboard is a part of XBoard package. It is not used by default,
only when explicitely called.

More info: http://www.tim-mann.org/xboard.html

The BUG:

pxboard in XBoard 4.2.6 and older creates/writes to a file with
a predictable filename in /tmp directory. In a multiuser environment
malicious user could use this vulnerability to force pxboard user to
overwrite any file she has write access to.

The fix:

1) Upgrade to XBoard 4.2.7

OR

2) Replace pxboard script with the following one:

#!/bin/sh
tmp=`mktemp "${TMPDIR:-/tmp}/pxboard.$$.XXXXXX"` || exit 1
cat > "$tmp"
( xboard -ncp -lgf "$tmp" "$@" ; rm "$tmp" ) &

-- 
   martin.macok@underground.cz        http://Xtrmntr.org/ORBman/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC