bzip2 TOCTOU file-permissions vulnerability

[Imran Ghory <imranghory () gmail com>]

================================
bzip2 TOCTOU file-permissions vulnerability 
================================

Software: bzip2
Version: 1.0.2
Software URL: <http://sources.redhat.com/bzip2/>
Platform:  Unix, Linux.
Vulnerability type: Time-of-Check-Time-Of-Use
Severity: Low, requires local attacker and badly set directory permissions.


Vulnerable software
====================

bzip2 1.0.2 and previous versions running on unix. 

bzip2 1.0.2 compiled for Windows using lcc or MS Visual C++  is not effected.

Vulnerability
============== 

If a malicious local user has write access to a directory in which a
target user is using bzip2 to extract or compress a file to then a
TOCTOU bug can be exploited to change the permission of any file
belonging to that user.

On decompressing bzip2 copies the permissions from the compressed
bzip2 file to the
uncompressed file. However there is a gap between the uncompressed
file being written (and it's file handler being close) and the
permissions of the file being changed.

During this gap a malicious user can remove the decompressed file and
replace it with a hard-link to another file belonging to the user.
bzip2 will then change the permissions on the  hard-linked file to be
the same as that of the bzip2 file.

Fix
====

Ensure that any directory which is being used by bzip2 to
compress/decompress files is only writeable by the user or
alternatively set the sticky bit on the directory's permissions