CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)

["Vincent Danen" <vdanen () redhat com>]

I don't believe a CVE has been assigned or requested for this yet.  Spotted this on Debian's bug tracker and filed our 
own bug, the description of which follows which should serve to describe the issue.  I'm not sure if this affects IBM's 
JDK, but it seems to affect Oracle's (based on a quick test on my mac), so cc'ing Oracle here.

I'm not sure if MITRE will be handling the assignment or if Oracle will, but as this had already been reported publicly 
to the Debian BTS, I didn't think there was a point in _not_ sending this to oss-sec.

Thanks.



Jakub Wilk reported in a Debian bug report that the unpack200 program included in OpenJDK did not properly handle the 
logfile properly.  If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the 
fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6):

4732 void unpacker::redirect_stdio() {
...
4757 #else
4758     sprintf(tmpdir,"/tmp");
4759     sprintf(log_file_name, "/tmp/unpack.log");
4760 #endif
4761     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4762       log_file = errstrm_name = saveStr(log_file_name);
4763       return ;
4764     }
4765
4766     char *tname = tempnam(tmpdir,"#upkg");
4767     sprintf(log_file_name, "%s", tname);
4768     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4769       log_file = errstrm_name = saveStr(log_file_name);
4770       return ;
4771     }

The same exists in OpenJDK 7 and 8.

This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be 
overwritten if the user running unpack200 had write permissions.


References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562
https://bugzilla.redhat.com/show_bug.cgi?id=1060907

-- 
Vincent Danen / Red Hat Security Response Team

Attachment: signature.asc
Description: OpenPGP digital signature