[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120410034316.GL16793@ngolde.de>
Date: Tue, 10 Apr 2012 05:43:16 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Cc: asterix@...aule.org
Subject: gajim insecure file creation when using latex
Hi,
Gajim seems to support latex in instant messages. This is implemented by
dumping the content to a .tex template on disk and converting the result to an
image. To prevent security problems, it is at least checking the input for
dangerous latex commands such as \input (as far as I can see nothing is
missing from this list).
However, it fails to create this temporary file in a secure manner:
From src/common/latex.py:
60 def get_tmpfile_name():
61 random.seed()
62 int_ = random.randint(0, 100)
63 return os.path.join(gettempdir(), 'gajimtex_' + int_.__str__())
...
113 def latex_to_image(str_):
114 result = None
115 exitcode = 0
116
117 try:
118 bg_str, fg_str = gajim.interface.get_bg_fg_colors()
119 except:
120 # interface may not be available when we test latext at startup
121 bg_str, fg_str = 'rgb 1.0 1.0 1.0', 'rgb 0.0 0.0 0.0'
122
123 # filter latex code with bad commands
124 if check_blacklist(str_):
125 # we triggered the blacklist, immediately return None
126 return None
127
128 tmpfile = get_tmpfile_name()
130 # build latex string
131 write_latex(os.path.join(tmpfile + '.tex'), str_)
and finally:
65 def write_latex(filename, str_):
66 texstr = '\\documentclass[12pt]{article}\\usepackage[dvips]{graphicx}'
67 texstr += '\\usepackage{amsmath}\\usepackage{amssymb}'
68 texstr += '\\pagestyle{empty}'
69 texstr += '\\begin{document}\\begin{large}\\begin{gather*}'
70 texstr += str_
71 texstr += '\\end{gather*}\\end{large}\\end{document}'
72
73 file_ = open(filename, "w+")
74 file_.write(texstr)
75 file_.flush()
76 file_.close()
I think this is of pretty minor severity even though it still allows a local attacker
to overwrite files the victim has write access to with latex content by using symlinks
and latex IMs are used.
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
