Re: Adobe Acrobat creates world writable ~/AdobeFnt.lst files

From: Darren Moffat (Darren.Moffatat_private)
Date: Wed Aug 22 2001 - 10:35:07 PDT

  • Next message: Lucian Hudin: "sample exploit....Re: *ALERT* UPDATED BID 3163 (URGENCY 6.58): Sendmail Debugger Arbitrary Code Execution Vulnerability (fwd)"

    >Adobe Acrobat creates world writable ~/AdobeFnt.lst files
    >
    >This problem is present in at least the Linux version:
    >ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/linux-ar-405.tar.gz
    >
    >Even with umask as restrictive as 077, the Adobe binary explicitly
    >creates and changes the AdobeFnt.lst file in the HOME directory to be
    >world (and group) writable.
    
    What anoys me almost as much as ignoring the umask is that this file
    is placed directly into $HOME and isn't a "." file.
    
    >Vendor notified: on or before 2001-03-02
    
    I notified Adobe of this on October 27th 1999 and never got any reply,
    see attached.
    
    
    Another possible workaround would be to create a shared object that
    replaced the open/chmod calls that change the permissions on the file,
    this could then be LD_PRELOAD'd so that acroread doesn't do the wrong thing.
    
    Using truss on Solaris we can easily see that acroread actually makes
    an explicit call to set the permissions to 0666.
    
    251032: open("/home/darrenm/AdobeFnt.lst", O_WRONLY|O_CREAT|O_TRUNC, 01) = 6
    251032: fchmod(6, 0666)         
    
    --
    Darren J Moffat
    
    
    
    
    ------------- Begin Included Message -------------
    



    This archive was generated by hypermail 2b30 : Wed Aug 22 2001 - 10:40:15 PDT