File:Temp::_is_safe() allows unsafe traversal of symlinks [rt.cpan.org #69106]

[xdg]

https://rt.cpan.org/Ticket/Display.html?id=69106

Example...

As user "attacker":

ln -s /tmp /tmp/exploit

As user "victim":

perl -MFile::Temp -e 'File::Temp->safe_level(File::Temp::HIGH); print
File::Temp::tempdir("/tmp/exploit/meXXXX") . "\n";'

The temporary directory path that is returned includes the symlink owned
by the "attacker" user.

[0-wiz-0]

This is CVE-2011-4116 - is someone working on fixing this?

[karenetheridge]

probably not. perlsec might not be aware.

[0-wiz-0]

How can we make them aware? :)

[mauke]

I don't really understand this issue. Sure, you could patch _is_safe to verify the entire chain of parent directories or whatever, but what's the point? It's a name-based check, so it will always suffer from race conditions (time-of-check vs. time-of-use). Any safety assurance it gives is potentially out-of-date by the time it returns.

(Also, it is internally racy: It calls stat separately three times on its argument for no good reason.)

[robinsmidsrod]

@mauke Have you read the analysis at https://seclists.org/oss-sec/2011/q4/234 ? It seems to go into great detail. If you haven't read it, it might assist in understanding the problem better.