CVE-2008-4108

Local users can overwrite files using symlink attack in Python 2.4.5 via temporary file (tmp$RANDOM.tmp)

• CVSS 7.2
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• Input Validation and Sanitization
• Local

Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.

CVE

CVE-2008-4108

CWE

CWE-59 Improper Link Resolution Before File Access ('Link Following')

CVSS base score

7.2

Published

2008-09-18

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Python to version 2.4.6 or higher.

import os
import random

def move_faqwiz(source, destination):
    temp_file_path = f"tmp{random.randint(1, 100000)}.tmp"
    
    with open(temp_file_path, 'wb') as temp_file:
        with open(source, 'rb') as src_file:
            data = src_file.read()
            temp_file.write(data)

    os.rename(temp_file_path, destination)

import os
import tempfile

def move_faqwiz(source, destination):
    with tempfile.NamedTemporaryFile(delete=False) as temp_file:
        temp_file_path = temp_file.name
    
    try:
        with open(source, 'rb') as src_file:
            data = src_file.read()
            temp_file.write(data)

        if os.path.dirname(destination) and os.access(os.path.dirname(destination), os.W_OK):
            os.rename(temp_file_path, destination)
        else:
            raise PermissionError("Destination directory is not writable or secure.")
    
    finally:
        if os.path.exists(temp_file_path):
            os.remove(temp_file_path)

@misc{vaitp:cve20084108,
  title        = {{Local users can overwrite files using symlink attack in Python 2.4.5 via temporary file (tmp$RANDOM.tmp)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2008},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2008-4108},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-4108/}}
}