[Secure-testing-team] Bug#701211: pktstat: writes content from TCP streams to public readable file /tmp/smtp.log

[Sven Hartge]

Package: pktstat
Version: 1.8.5-2
Severity: normal
Tags: security

Hi!

I noticed pktstat creates a file with a fixed name in /tmp and writes debugging
info gathered from the sniffed TCP streams into it:

redacted:/tmp# ls -al smtp.log
-rw-r--r-- 1 root root 236726 Feb 22 21:30 smtp.log

Content is something like this:

-----------8<---------------------
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
-----------8<---------------------

This is troublesome on several levels in my opinion:

a) the filename is always the same. Since pktstat is normally run as root, this
   can be used for a symlink attack, at least to overwrite important files with
   garbage

b) the file is normally world readable, depending on root's umask and may contain
   sensitive information.

c) if pktstat is left running for some time on a busier network interface, this
   logfile can get quite big and possibly fill /tmp or /.

The code responsible is in tmp_smtp.c:

oweh at hostname:~/apt/pktstat-1.8.5$ grep log *
tcp_smtp.c:FILE*log;
tcp_smtp.c:if ((log = fopen("/tmp/smtp.log", "a")))
tcp_smtp.c:   fprintf(log, "smpt_line [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "normalized to [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "from_addr = [%s]\n", state->from_addr);
tcp_smtp.c:if (log)fprintf(log, "to_addr = [%s]\n", state->to_addr);
tcp_smtp.c:if (log)fprintf(log, "set desc to: [%s]\n", f->desc);
tcp_smtp.c:if (log)fclose(log);

>From the indention and formatting of said code I gather it is leftover debug
code, never intended to be released.

Just removing all of the above lines is sufficient to close this bug.

Grüße,
Sven.


-- System Information:
Debian Release: 7.0
  APT prefers unstable
  APT policy: (600, 'unstable'), (500, 'experimental'), (400, 'testing')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.7-trunk-amd64 (SMP w/12 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages pktstat depends on:
ii  libc6        2.13-38
ii  libncurses5  5.9-10
ii  libpcap0.8   1.3.0-1
ii  libtinfo5    5.9-10

pktstat recommends no packages.

pktstat suggests no packages.

-- no debconf information