[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#77257: FWD: Joe's Own Editor File Link Vulnerability

On Fri, Nov 17, 2000 at 03:26:04PM +0100, Josip Rodin wrote:
> On Thu, Nov 16, 2000 at 11:21:15PM -0800, Joey Hess wrote:
> > Package: joe
> > Version: 2.8
> > Severity: important
> > 
> >  FILE *f=fopen("DEADJOE","a");
> > 
> > Looks vulnerable indeed. Amusingly Debian has already patched right
> > abve this line to not make the DEADJOE file mode 755, to prevent
> > sensitive data (/etc/shadow) leakage. We were so close..

> The fix would be to use open(2) and set the O_EXCL flag so it bails out?

A fix, but it breaks the intended behaviour ("a" for append IIRC). Putting 
DEADJOE in $HOME might be a nicer solution?

Unfortunately most editors are vulnerable to problems like this (indeed, 
most are far more serious than this). I submitted patches for similar problems 
in vim to the upstream just a few weeks ago, for instance; jed also had similar 
problems (bug #51213). And those are just the ones I've used...

Colin Phipps                            http://www.netcraft.com/

Reply to: