Ubuntu
unity package

lens-bar-keynavigation periodically writes to /tmp/wut.png

Bug #1051921 reported by Jean-Paul Calderone on 2012-09-17

This bug affects 3 people

	Status	Importance	Assigned to	Milestone
Unity	Fix Released	Medium	Stephen M. Webb	Unity 7.1.1 "S Series"
5.0	Fix Released	Medium	Stephen M. Webb	Unity 5.26.0 "SRU-7"
unity (Ubuntu)	Fix Released	Low	Stephen M. Webb
Precise	Won't Fix	Low	Stephen M. Webb

Bug Description

[Impact]

* Style::SquareButton writes a small png to /tmp/wut.png
* If a user creates /tmp/wut.png as a symlink to some file on the system writeable by the owner of the unity process, then he/she can destroy that file.

[Test Case]

* log out
* log in with the upgraded package
* open the terminal application using control-alt-T, ensure the terminal is focused
* invoke the HUD by pressing the Alt key and typing f (the HUD menu selection 'drop
down' must appear to trigger the png file write)
* check for presence of "/tmp/wut.png"

[Regression Potential]

* n/a

[Other Info]

* Marc Deslauriers from the security team said it isn't a problem on Ubuntu because we have symlink restrictions (in this case part of the Yama LSM [1]).

* We believe, not everyone is necessarily running Yama LSM.

See original description

Tags:

Related branches

lp:~bregma/unity/lp-1051921

Merged into lp:unity at revision 3472

PS Jenkins bot (community): Approve (continuous-integration) on 2013-08-16

Brandon Schaefer (community): Approve on 2013-08-16

lp:~bregma/unity/lp-1051921-5.0

Merged into lp:unity/5.0 at revision 2423

Brandon Schaefer (community): Approve on 2013-08-16

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-10-04:

No security impact because of the symlink restrictions in Ubuntu....it's just...bad coding.

security vulnerability:	yes → no
visibility:	private → public

Revision history for this message

Paul Tagliamonte (paultag) wrote on 2013-07-07:

Verified by a trusted friend, and Unity has the following line from the diff ref'd above:

cairo_surface_write_to_png(cairo_get_target(cr), "/tmp/wut.png");

Seriously unclean. Also, unsafe usage of tmp.

Changed in unity (Ubuntu):
importance:	Undecided → Low
status:	New → Triaged

Revision history for this message

Sven Mueller (smu-u) wrote on 2013-07-29:

The symlink restrictions are solely in the kernel, which people might have to replace for various reasons. In other words: It might not be a security issue on plain - unmodified - Ubuntu, but it is still a security issue.
Just sayin'

Paul Tagliamonte (paultag) on 2013-08-15

Changed in unity (Ubuntu Precise):
status:	New → Triaged
importance:	Undecided → Low

Stephen M. Webb (bregma) on 2013-08-15

Changed in unity:
milestone:	none → 7.1.2
status:	New → Triaged
importance:	Undecided → Medium

Stephen M. Webb (bregma) on 2013-08-15

Changed in unity:
status:	Triaged → In Progress
Changed in unity (Ubuntu):
status:	Triaged → In Progress
Changed in unity (Ubuntu Precise):
status:	Triaged → In Progress
Changed in unity:
assignee:	nobody → Stephen M. Webb (bregma)
Changed in unity (Ubuntu):
assignee:	nobody → Stephen M. Webb (bregma)
Changed in unity (Ubuntu Precise):
assignee:	nobody → Stephen M. Webb (bregma)

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2013-08-16:

Fix committed into lp:unity at revision None, scheduled for release in unity, milestone 7.1.1

Changed in unity:
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2013-08-16:

This bug was fixed in the package unity - 7.1.0+13.10.20130816.3-0ubuntu1

---------------
unity (7.1.0+13.10.20130816.3-0ubuntu1) saucy; urgency=low

  [ Michal Hruby ]
  * Make sure we emit row_added signals for all rows present in a model
    when changing a model Model::SetModel(). (LP: #1212580)

  [ Andrew McCarthy ]
  * added photo lens shortcut to the shortcuts hint window (lp:
    #1069644). (LP: #1069644)

  [ Stephen M. Webb ]
  * added photo lens shortcut to the shortcuts hint window (lp:
    #1069644). (LP: #1069644)
  * removed debug output thatcould cause a potential security problem
    (lp: #1051921). (LP: #1051921)

  [ Nick Dedekind ]
  * Don't re-add the rows for filters and categories if the model
    changes.
  * Fixed duplicate categories in scope caused by full resync on model
    change. (LP: #1212945)

  [ Chris Townsend ]
  * Fix issue where the same app on different workspaces would not allow
    alt-tab to work properly when trying to switch to the last used app
    on the same workspace. (LP: #1211261)

[ Ubuntu daily release ]
* Automatic snapshot from revision 3473
-- Ubuntu daily release <email address hidden> Fri, 16 Aug 2013 11:47:59 +0000

Changed in unity (Ubuntu):
status:	In Progress → Fix Released

Ritesh Khadgaray (khadgaray) on 2013-08-19

description:	updated
tags:	added: precise

Revision history for this message

Ritesh Khadgaray (khadgaray) wrote on 2013-08-19:

proposed patch for precise Edit (1.6 KiB, text/plain)

Ritesh Khadgaray (khadgaray) on 2013-08-20

description:	updated
description:	updated

Stephen M. Webb (bregma) on 2013-08-20

description:

updated

Revision history for this message

Paul Tagliamonte (paultag) wrote on 2013-08-20:

Thanks, Y'all!

Marco Trevisan (Treviño) (3v1n0) on 2013-09-02

Changed in unity (Ubuntu Precise):
status:	In Progress → Fix Committed

Revision history for this message

Iain Lane (laney) wrote on 2013-09-17:

Don't see there is anything for sponsors to do here (it's merged in precise's branch already).

Stephen M. Webb (bregma) on 2013-10-10

Changed in unity:
milestone:	7.1.2 → 7.1.1
status:	Fix Committed → Fix Released

Revision history for this message

Mark Russell (marrusl) wrote on 2013-11-21:

Any idea when this will be SRU'd to Precise? It's been merged for a few months now.

John Kim (kotux) on 2014-02-16

Changed in unity (Ubuntu Precise):
status:	Fix Committed → Fix Released

Revision history for this message

Margarita Manterola (marga-9) wrote on 2014-03-24:

#10

Actually, it doesn't seem to be fixed in Precise. This is the latest changelog entry of the current Precise version:

unity (5.20.0-0ubuntu3) precise-proposed; urgency=low

  * Add initial support for pointer barriers with xinput2 api. (LP: #1242633)
    - Fallback to xfixes stays available.
  * Bump dependencies to compile with both pointer barriers implementations.

-- Maarten Lankhorst <email address hidden> Thu, 05 Sep 2013 11:58:32 +0200

It's 0ubuntu3 as the one in the proposed patch, but it's actually a completely different entry, referencing a different bug.

Sebastien Bacher (seb128) on 2014-03-28

Changed in unity (Ubuntu Precise):
status:	Fix Released → Triaged

Revision history for this message

Margarita Manterola (marga-9) wrote on 2014-03-28:

#11

As can be seen in http://bazaar.launchpad.net/~unity-team/unity/5.0/changes/2425?start_revid=2425, the commit was submitted in revision 2423, but there have been no Unity 5 releases after that.

Is there going to be a last Unity 5 release, or is 5.20 the last one?

Revision history for this message

Steve Langasek (vorlon) wrote on 2021-10-14:

#12

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

Changed in unity (Ubuntu Precise):
status:	Triaged → Won't Fix

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

proposed patch for precise Edit

Add patch

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntuunity package

lens-bar-keynavigation periodically writes to /tmp/wut.png

Bug Description

Related branches

Other bug subscribers

Patches

Remote bug watches

Ubuntu
unity package