87249 2002-12-23 17:10 /185 rader/ Paul Szabo <psz@maths.usyd.edu.au>
Importerad: 2002-12-23 17:10 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: full-disclosure@netsys.com
Mottagare: Bugtraq (import) <2861>
Ärende: Matlab /tmp usage
------------------------------------------------------------
INTRODUCTION
MATLAB is "The Language of Technical Computing"
http://www.mathworks.com/
PROBLEM
As installed on UNIX machines, matlab uses shell scripts to launch;
these scripts use files in /tmp in an unsafe way.
DETAILS
The matlab script uses /tmp/$$a and may clobber it, allowing an
attacker to "wipe out" any file belonging to the matlab user. Suppose
the attacker guesses what PID will be used next and creates a symlink
with
ln -s ~victim/.profile /tmp/PIDa
then waits for the victim to run matlab: the victim's .profile gets
overwritten with garbage. (If root ever uses matlab then any file,
e.g. /etc/passwd, could similarly be trashed.)
It might be argued that it is hard to guess what PID will be used
next. It is easy enough to create a few thousand symlinks with
likely PIDs; in fact the attacker could create a symlink for every
possible PID (as these normally range from 0 to 32k or 64k).
The mex script may similarly clobber both /tmp/$$a and
/tmp/$$b. Worse, it sources (executes) any existing /tmp/$$a script,
allowing an attacker to execute any commands as the mex
user. Proof-of-concept (script-kiddie-safe) code:
echo 'echo You lose: rm -rf $HOME >> $HOME/.profile' > /tmp/evil
perl -e 'for (1..32000) { symlink "/tmp/$_a", "/tmp/evil" }'
then wait for any victim to use mex (if root ever uses mex then any
actions may be taken).
VENDOR COMMUNICATION
5 Dec 2002 MathWorks notified 10 Dec 2002 case ID is: 1034529 16
Dec 2002 engineers [will] try to validate 18 Dec 2002 working on a
solution for the next release of MATLAB R14 18 Dec 2002 if you have
a WORKING fix ... [recommend] comp.soft-sys.matlab
WORKAROUND/PATCH
I suggest you use something similar to the following
patches. (Standard textbook techniques: use a safe directory, and do
not use files at all.)
*** matlab/6.5/bin/matlab.old Tue Sep 24 10:52:30 2002
--- matlab/6.5/bin/matlab Thu Dec 19 08:36:04 2002
***************
*** 137,145 ****
#
# Temporary file that hold MATLABPATH code from .matlab6rc.sh file.
#
! temp_file=/tmp/$$a
#
! trap "rm -f $temp_file; exit 1" 1 2 3 15
#
#========================= archlist.sh (start) ============================
#
--- 137,147 ----
#
# Temporary file that hold MATLABPATH code from .matlab6rc.sh file.
#
! temp_dir=/tmp/$$a
! temp_file=$temp_dir/a
! mkdir -m 700 $temp_dir || exit 1
#
! trap "rm -rf $temp_dir; exit 1" 1 2 3 15
#
#========================= archlist.sh (start) ============================
#
***************
*** 1790,1798 ****
echo '------------------------------------------------------------------------') >> $temp_file
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
more $temp_file
! rm -f $temp_file
exit 0
fi
#
# Export the variables
#
--- 1792,1801 ----
echo '------------------------------------------------------------------------') >> $temp_file
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
more $temp_file
! rm -rf $temp_dir
exit 0
fi
+ rm -rf $temp_dir
#
# Export the variables
#
*** matlab/6.5/bin/mex.old Tue Sep 24 10:52:30 2002
--- matlab/6.5/bin/mex Thu Dec 19 11:07:34 2002
***************
*** 1014,1021 ****
exit 1
fi
if [ "$verbose" = "1" ]; then
! temp_file=/tmp/$$b
! files_to_remove="$files_to_remove $temp_file"
. $MATLAB/bin/util/oscheck.sh
if [ "$oscheck_status" = "1" ]; then
cleanup
--- 1014,1023 ----
exit 1
fi
if [ "$verbose" = "1" ]; then
! temp_dir=/tmp/$$b
! temp_file=$temp_dir/b
! files_to_remove="$files_to_remove $temp_dir"
! mkdir -m 700 $temp_dir || exit 1
. $MATLAB/bin/util/oscheck.sh
if [ "$oscheck_status" = "1" ]; then
cleanup
***************
*** 1031,1038 ****
#
# Source the file of argument variables, name=[def]
#
! if [ -f /tmp/$$a ]; then
! . /tmp/$$a
fi
#
--- 1033,1043 ----
#
# Source the file of argument variables, name=[def]
#
! #if [ -f /tmp/$$a ]; then
! # . /tmp/$$a
! #fi
! if [ -n "$EVAL_ASSIGNS" ]; then
! eval "$EVAL_ASSIGNS"
fi
#
***************
*** 1505,1510 ****
--- 1510,1516 ----
ARCH=
Arch='Undetermined'
verbose=0
+ EVAL_ASSIGNS=
#
# Use a C entry point by default
#
***************
*** 1698,1705 ****
*[=\#]*)
lhs=`expr "$1" : '\([a-zA-Z0-9_]*\)[=\#].*'`
rhs=`expr "$1" : '[a-zA-Z0-9_]*[=\#]\(.*\)$'`
! echo $lhs='"'$rhs'"' >> /tmp/$$a
! files_to_remove="$files_to_remove /tmp/$$a"
;;
*.c) # c source file.
cfiles='1'
--- 1704,1712 ----
*[=\#]*)
lhs=`expr "$1" : '\([a-zA-Z0-9_]*\)[=\#].*'`
rhs=`expr "$1" : '[a-zA-Z0-9_]*[=\#]\(.*\)$'`
! #echo $lhs='"'$rhs'"' >> /tmp/$$a
! #files_to_remove="$files_to_remove /tmp/$$a"
! EVAL_ASSIGNS="$EVAL_ASSIGNS$lhs="'"'"$rhs"'";'
;;
*.c) # c source file.
cfiles='1'
SIGNATURE
Paul Szabo - psz@maths.usyd.edu.au http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics University of Sydney 2006 Australia
(87249) /Paul Szabo <psz@maths.usyd.edu.au>/(Ombruten)