Package: bokken Version: 1.5-2 Severity: important Tags: security An attacker on a multi-user system can overwrite an arbitrary file owned by the user running bokken by creating a symlink named /tmp/graph.dot:
pabs@chianamo ~ $ ls -l foo /tmp/graph.dot
ls: cannot access foo: No such file or directory
lrwxrwxrwx 1 nobody nogroup 14 Dec 13 18:56 /tmp/graph.dot -> /home/pabs/foo
pabs@chianamo ~ $ bokken /bin/ls
Python version... OK
Checking:
Pyew availability... D'oh!
You need pyew in order to use pyew backend in binaries and PDFs. Download it
from its web:
- http://code.google.com/p/pyew/
Radare availability... OK
GTK UI dependencies... OK
GtkSourceView2... OK
Psyco availability... D'oh!
No psyco module found. It's recomended to use it to improve performance
Tidy availability... OK
Starting bokken, running on:
Python version:
2.7.2+ (default, Oct 5 2011, 10:41:47)
[GCC 4.6.1]
GTK version: 2.24.8
PyGTK version: 2.24.0
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/rightnotebook.py", line 149, in on_switch
self.xdot_box.set_dot(self.uicore.get_callgraph(self.last_fcn))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
[*] Get text dasm
* Let's get the dasm for .init... OK!
/tmp/graph.dot created
* Let's get the dasm for .plt... OK!
* Let's get the dasm for .text... OK!
* Let's get the dasm for .fini... OK!
DEBUG: DASM finished, reading from queue!
Process state True
DEBUG: Got a disassembly of 951575 bytes.
DEBUG: Section lines created [12, 689, 19271, 8, 19980]
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/main.py", line 309, in
merge_dasm_rightextview
self.tviews.update_graph(self, link_name)
File "/usr/share/pyshared/bokken/ui/textviews.py", line 386, in update_graph
self.right_notebook.xdot_box.set_dot(self.uicore.get_callgraph(addr))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/rightnotebook.py", line 149, in on_switch
self.xdot_box.set_dot(self.uicore.get_callgraph(self.last_fcn))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
pabs@chianamo ~ $ ls -l foo /tmp/graph.dot
-rw-r----- 1 pabs pabs 664 Dec 13 18:57 foo
lrwxrwxrwx 1 nobody nogroup 14 Dec 13 18:56 /tmp/graph.dot -> /home/pabs/foo
pabs@chianamo ~ $ cat foo
digraph code {
graph [bgcolor=white];
node [color=lightgray, style=filled shape=box fontname="Courier"
fontsize="8"];
"0x004046d4_0x004046d4" [URL="entry0/0x004046d4" color="lightgray", label="/
function: entry0 (42)\l| 0x004046d4 entry0:\l| 0x004046d4 xor ebp, ebp\l|
0x004046d6 mov r9, rdx\l| 0x004046d9 pop rsi\l| 0x004046da mov rdx,
rsp\l| 0x004046dd and rsp, 0xfffffffffffffff0\l| 0x004046e1 push rax\l|
0x004046e2 push rsp\l| 0x004046e3 mov r8, 0x412500\l| 0x004046ea mov rcx,
0x412510\l| 0x004046f1 mov rdi, section_end..plt\l| 0x004046f8 call dword
imp.__libc_start_main\l| ; imp.__libc_start_main()\l\ 0x004046fd hlt\l"]
}
pabs@chianamo ~ $ bokken /bin/ls
Python version... OK
Checking:
Pyew availability... D'oh!
You need pyew in order to use pyew backend in binaries and PDFs. Download it
from its web:
- http://code.google.com/p/pyew/
Radare availability... OK
GTK UI dependencies... OK
GtkSourceView2... OK
Psyco availability... D'oh!
No psyco module found. It's recomended to use it to improve performance
Tidy availability... OK
Starting bokken, running on:
Python version:
2.7.2+ (default, Oct 5 2011, 10:41:47)
[GCC 4.6.1]
GTK version: 2.24.8
PyGTK version: 2.24.0
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/rightnotebook.py", line 149, in on_switch
self.xdot_box.set_dot(self.uicore.get_callgraph(self.last_fcn))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
[*] Get text dasm
* Let's get the dasm for .init... OK!
/tmp/graph.dot created
* Let's get the dasm for .plt... OK!
* Let's get the dasm for .text... OK!
* Let's get the dasm for .fini... OK!
DEBUG: DASM finished, reading from queue!
Process state True
DEBUG: Got a disassembly of 951552 bytes.
DEBUG: Section lines created [12, 689, 19271, 8, 19980]
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/rightnotebook.py", line 149, in on_switch
self.xdot_box.set_dot(self.uicore.get_callgraph(self.last_fcn))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
/tmp/graph.dot created
Traceback (most recent call last):
File "/usr/share/pyshared/bokken/ui/main.py", line 309, in
merge_dasm_rightextview
self.tviews.update_graph(self, link_name)
File "/usr/share/pyshared/bokken/ui/textviews.py", line 386, in update_graph
self.right_notebook.xdot_box.set_dot(self.uicore.get_callgraph(addr))
File "/usr/share/pyshared/bokken/ui/radare_core.py", line 397, in
get_callgraph
os.unlink(file)
OSError: [Errno 1] Operation not permitted: '/tmp/graph.dot'
pabs@chianamo ~ $ ls -l foo /tmp/graph.dot
-rw-r----- 1 pabs pabs 664 Dec 13 19:02 foo
lrwxrwxrwx 1 nobody nogroup 14 Dec 13 18:56 /tmp/graph.dot -> /home/pabs/foo
pabs@chianamo ~ $ cat foo
digraph code {
graph [bgcolor=white];
node [color=lightgray, style=filled shape=box fontname="Courier"
fontsize="8"];
"0x004046d4_0x004046d4" [URL="entry0/0x004046d4" color="lightgray", label="/
function: entry0 (42)\l| 0x004046d4 entry0:\l| 0x004046d4 xor ebp, ebp\l|
0x004046d6 mov r9, rdx\l| 0x004046d9 pop rsi\l| 0x004046da mov rdx,
rsp\l| 0x004046dd and rsp, 0xfffffffffffffff0\l| 0x004046e1 push rax\l|
0x004046e2 push rsp\l| 0x004046e3 mov r8, 0x412500\l| 0x004046ea mov rcx,
0x412510\l| 0x004046f1 mov rdi, section_end..plt\l| 0x004046f8 call dword
imp.__libc_start_main\l| ; imp.__libc_start_main()\l\ 0x004046fd hlt\l"]
}
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (700, 'testing'), (600, 'unstable'), (550, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.1.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages bokken depends on:
ii python 2.7.2-9
ii python-gtk2 2.24.0-2
ii python-gtksourceview2 2.10.1-2
ii python-radare2 0.9-1
ii python2.6 2.6.7-4
ii python2.7 2.7.2-7
--
bye,
pabs
http://wiki.debian.org/PaulWise
signature.asc
Description: This is a digitally signed message part
