busybox/editors
Rob Landley 5797c7f0ef Doug Swarin pointed out a security bug in the -i option of sed.
While the permissions on the temp file are correct to prevent it from being 
maliciously mangled by passing strangers, (created with 600, opened O_EXCL, 
etc), the permissions on the _directory_ might not be, and we re-open the 
file to convert the filehandle to a FILE * (and automatically get an error 
message and exit if the directory's read-only or out of space or some such).

This opens a potential race condition if somebody's using dnotify on the 
directory, deletes/renames the tempfile, and drops a symlink or something 
there.  Somebody running sed -i as root in a world writeable directory could 
do damage.

I dug up notes on an earlier discussion where we looked at the security 
implications of this (unfortunately on the #uclibc channel rather than email; 
I don't have a transcript, just notes-to-self) which pointed out that if the 
permissions on the directory allow other people's files to be deleted/renamed 
then the original file is vulnerable to sabotage anyway.  However, there are 
two cases that discussion apparently didn't take into account:

1) Using another user's permissions to damage files in other directories you 
can't access (standard symlink attack).

2) Reading data another user couldn't otherwise access by having the new file 
belong to that other user.

This patch uses fdopen to convert the filehandle into a FILE *, rather than
reopening the file.
2005-05-18 05:56:16 +00:00
..
awk.c Patch from Dmitry Zakharov to fix a bug triggered by freeswan's scripts. 2004-09-24 09:24:27 +00:00
Config.in Remove trailing whitespace. Update copyright to include 2004. 2004-03-15 08:29:22 +00:00
Makefile egor duda writes: 2004-10-08 07:46:08 +00:00
Makefile.in egor duda writes: 2004-10-08 07:46:08 +00:00
patch.c Update my email address, document some of my tasks in the AUTHORS file 2004-04-25 05:11:19 +00:00
sed.c Doug Swarin pointed out a security bug in the -i option of sed. 2005-05-18 05:56:16 +00:00
vi.c In Bug 208, bernhardf writes: 2005-04-16 04:30:38 +00:00