Re: zsh/files module and insecure tempfile creation

[Daniel Shahaf <d.s@daniel.shahaf.name>]

Bart Schaefer wrote on Fri, Jan 09, 2015 at 22:31:50 -0800:
> I'm trying to work through the "attack vector" for the mv -f trick.
> The situation is that a script wants to create a plain empty file
> with a known name, let's say "/tmp/zsh12345".
> 
> If the attacker creates his own plain file named /tmp/zsh12345 then the
> "mv -f" will clobber it, so that's not at issue.  Therefore an attack
> is possible if the attacker can create a directory (or symlink to a
> directory) named /tmp/zsh12345 and writable by the zsh process,
> because then mv will put the empty plain file inside that directory.
> 
> Next the attacker must be able to swap the directory or symlink with
> a symlink to his own target file.  Presumably if he could create it
> in the first place, he can swap it.  So we do have an attack that can
> clobber any file writable by the zsh user.  Anybody disagree?

On FreeBSD systems, 'cat /path/to/dir' works (prints something and
returns 0).  Therefore, even if the (symlink-to-)dir is not replaced by
a file, unexpected effects might be caused when some code attempts to
cat the tempfile (which is in fact a directory) — whether in order to
run it as shell commands or in order to use it as data.

Sorry, but I haven't audited the patch to see what exactly this could
cause in each instance.  (No time.)

Daniel