CVE-2013-4184: Insecure usage of /tmp/.UUID_STATE and /tmp/.UUID_NODEID about data-uuid

[stigtsp]

Some context for the above: Added the patches from #40 that removes the state files feature to nixpkgs, and tests for all reverse dependencies ran fine.

Removing the state files seems like a reasonable fix to me, unless I'm missing something.

[timretout]

I have requested a CVE id from oss-security, and I will come back and update the report when one is assigned.

[rjbs]

I really don't do anything on this library but apply patches. It's been without a dedicated maintainer almost since release. A patch for this issue would be appreciated.

[karenetheridge]

We should really fix this. A lot of production code uses it.

[eserte]

Anyway, what's the intention of these /tmp/.UUID* files? Maybe performance is the reason --- but actually, if all file operations were removed from UUID.xs, then constructing a Data::UUID object and run create_str() once is faster than before, at least on my linux system.

[rjbs]

I'm afraid I don't know. I really have never really read this code carefully. I have just been the de facto "apply patches, do test release, release afterward" person.

[tecordes]

Hi, I'm new to github, but a dev of 30 years. I have attempted a fix of this issue as it drives me nuts. I have attempted to get my commit/patch to link to this issue, I think it worked? No idea what I have to do now.
Anyhow you can see my changes in my commit link. My idea is to change from using tmp to using ENV{HOME}, with a fallback to tmp. And some other minor related tweaks. It's all done in C in the XS, not in perl or the makefile.

[briandfoy]

I looked at the merged commit, and wonder if this is still insecure. The attacker can still chose to have the file created in /tmp by choosing the value for $HOME. The filenames are still completely known, which is a big part of the problem.

As Slavic said, get rid of the external file altogether so there's no problem with files.

Typically, I've seen these steps for dealing with temp file race conditions:

• Add a varying and random part to the name. This should be hard to guess.
• Fail if the file already exists.
• Use lstat ensure that you have the file you think you do. Fail if you have a symlink.

[stigtsp]

• NixOS/nixpkgs#245193