COMMAND

	xsane temporary files vulnerability

SYSTEMS AFFECTED

	 Versions prior to the correction date

PROBLEM

	In FreeBSD Security Advisory FreeBSD-SA-01:68 :
	

	 Background

	 ==========

	

	The XSane application is a gtk based X11 front-end to the SANE  (Scanner
	Access Now Easy) library used to interface  with  scanners.  XSane  will
	acquire images using devices such as scanners and cameras.
	

	 Problem Description

	 ===================

	

	XSane creates temporary files in /tmp during  the  process  of  scanning
	images and to communicate with  SANE  (the  back-end  application  which
	actually performs the scans) during image preview and save.
	

	However XSane creates temporary files  using  mktemp(3),  which  can  be
	easily predicted (see the BUGS section of the mktemp(3) man page).  This
	makes XSane  vulnerable  to  exploit,  opening  the  opportunity  for  a
	user\'s files to be overwritten through a race condition.
	

	The xsane port is  not  installed  by  default,  nor  is  it  \"part  of
	FreeBSD\" as such: it is part of the  FreeBSD  ports  collection,  which
	contains  over  6000  third-party  applications  in  a  ready-to-install
	format. The ports collection shipped  with  FreeBSD  4.4  contains  this
	problem since it was discovered after the release.
	

	FreeBSD  makes  no  claim  about  the  security  of  these   third-party
	applications, although an effort  is  underway  to  provide  a  security
	audit of the most security-critical ports.
	

	 Impact

	 ======

	

	A local user may be able  to  cause  xsane  (run  by  another  user)  to
	overwrite any file for which the latter user has  sufficient  privilege.
	While it is advisable to run XSane with a non-privileged  user  account,
	many users run it using the root account, increasing the risk.
	

	

SOLUTION

	 Workaround

	 ==========

	

	Deinstall the xsane port/package if you have it installed.
	

	 Solution

	 ========

	

	1) Upgrade your entire ports collection and rebuild the port.
	

	2) Deinstall the old package and install a new package dated  after  the
	correction date, obtained from the following directories:
	

	

	[i386] 

	ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/graphics/xsane-0.82.tgz

	ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/graphics/xsane-0.82.tgz 

	

	

	 [alpha]

	Packages are not automatically generated for the alpha  architecture  at
	this time due to lack of build resources.
	

	NOTE: It may be several days before updated packages are  available.  Be
	sure to check the  file  creation  date  on  the  package,  because  the
	version number of the software has not changed.
	

	3) Download a new port skeleton for the xsane port from:
	

	 

	http://www.freebsd.org/ports/

	

	

	and use it to rebuild the port.
	

	4) Use the portcheckout  utility  to  automate  option  (3)  above.  The
	portcheckout port is available in /usr/ports/devel/portcheckout  or  the
	package can be obtained from:
	

	

	ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz 

	ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz 

	

	

	 Correction details

	 ==================

	

	The following list contains the revision numbers of each file  that  was
	corrected in the FreeBSD ports collection.
	

	

	Path                                                             Revision

	-------------------------------------------------------------------------

	ports/graphics/xsane/Makefile                                        1.30

	ports/graphics/xsane/distinfo                                        1.20

	ports/graphics/xsane/pkg-plist                                       1.18

	-------------------------------------------------------------------------