CVE-2013-2035: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2013-08-28T23:55Z
Repository: https://github.com/fusesource/hawtjni
Language: Java
Files changed: hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java
Commit date: 2013-05-13 08:41:14 -0400
Commit message: Simplify shared lib extraction.
Diff: diff --git a/hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java b/hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java
index c23081d..422bd2f 100755
--- a/hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java
+++ b/hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java
@@ -7,17 +7,15 @@
  * which accompanies this distribution, and is available at
  * http://www.eclipse.org/legal/epl-v10.html
  *******************************************************************************/
 package org.fusesource.hawtjni.runtime;
 
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
+import java.io.*;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.ArrayList;
+import java.util.Random;
 import java.util.regex.Pattern;
 
 /**
  * Used to optionally extract and load a JNI library.
  * 
@@ -204,30 +202,33 @@ public class Library {
 
     
     private boolean exractAndLoad(ArrayList<String> errors, String version, String customPath, String resourcePath) {
         URL resource = classLoader.getResource(resourcePath);
         if( resource !=null ) {
-            
+
             String libName = name + "-" + getBitModel();
             if( version !=null) {
                 libName += "-" + version;
             }
-            
+            String []libNameParts = map(libName).split("\\.");
+            String prefix = libNameParts[0]+"-";
+            String suffix = "."+libNameParts[1];
+
             if( customPath!=null ) {
                 // Try to extract it to the custom path...
-                File target = file(customPath, map(libName));
-                if( extract(errors, resource, target) ) {
+                File target = extract(errors, resource, prefix, suffix, file(customPath));
+                if( target!=null ) {
                     if( load(errors, target) ) {
                         return true;
                     }
                 }
             }
             
             // Fall back to extracting to the tmp dir
             customPath = System.getProperty("java.io.tmpdir");
-            File target = file(customPath, map(libName));
-            if( extract(errors, resource, target) ) {
+            File target = extract(errors, resource, prefix, suffix, file(customPath));
+            if( target!=null ) {
                 if( load(errors, target) ) {
                     return true;
                 }
             }
         }
@@ -257,71 +258,49 @@ public class Library {
             libName = libName.substring(0, libName.length() - ext.length()) + ".jnilib"; 
         }
         return libName;
     }
 
-    private boolean extract(ArrayList<String> errors, URL source, File target) {
-        FileOutputStream os = null;
-        InputStream is = null;
-        boolean extracting = false;
+    private File extract(ArrayList<String> errors, URL source, String prefix, String suffix, File directory) {
+        File target = null;
         try {
-            if (!target.exists() || isStale(source, target) ) {
+            FileOutputStream os = null;
+            InputStream is = null;
+            try {
+                target = File.createTempFile(prefix, suffix, directory);
                 is = source.openStream();
                 if (is != null) {
                     byte[] buffer = new byte[4096];
                     os = new FileOutputStream(target);
-                    extracting = true;
                     int read;
                     while ((read = is.read(buffer)) != -1) {
                         os.write(buffer, 0, read);
                     }
-                    os.close();
-                    is.close();
                     chmod("755", target);
                 }
+                target.deleteOnExit();
+                return target;
+            } finally {
+                close(os);
+                close(is);
             }
         } catch (Throwable e) {
-            try {
-                if (os != null)
-                    os.close();
-            } catch (IOException e1) {
-            }
-            try {
-                if (is != null)
-                    is.close();
-            } catch (IOException e1) {
-            }
-            if (extracting && target.exists())
+            if( target!=null ) {
                 target.delete();
+            }
             errors.add(e.getMessage());
-            return false;
         }
-        return true;
+        return null;
     }
 
-    private boolean isStale(URL source, File target) {
-        
-        if( source.getProtocol().equals("jar") ) {
-            // unwrap the jar protocol...
+    static private void close(Closeable file) {
+        if(file!=null) {
             try {
-                String parts[] = source.getFile().split(Pattern.quote("!"));
-                source = new URL(parts[0]);
-            } catch (MalformedURLException e) {
-                return false;
-            }
-        }
-        
-        File sourceFile=null;
-        if( source.getProtocol().equals("file") ) {
-            sourceFile = new File(source.getFile());
-        }
-        if( sourceFile!=null && sourceFile.exists() ) {
-            if( sourceFile.lastModified() > target.lastModified() ) {
-                return true;
+                file.close();
+            } catch (Exception ignore) {
             }
         }
-        return false;
     }
 
     private void chmod(String permision, File path) {
         if (getPlatform().startsWith("windows"))
             return; 

Vulnerable code: import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
            
            
                File target = file(customPath, map(libName));
                if( extract(errors, resource, target) ) {
            File target = file(customPath, map(libName));
            if( extract(errors, resource, target) ) {
    private boolean extract(ArrayList<String> errors, URL source, File target) {
        FileOutputStream os = null;
        InputStream is = null;
        boolean extracting = false;
            if (!target.exists() || isStale(source, target) ) {
                    extracting = true;
                    os.close();
                    is.close();
            try {
                if (os != null)
                    os.close();
            } catch (IOException e1) {
            }
            try {
                if (is != null)
                    is.close();
            } catch (IOException e1) {
            }
            if (extracting && target.exists())
            return false;
        return true;
    private boolean isStale(URL source, File target) {
        
        if( source.getProtocol().equals("jar") ) {
            // unwrap the jar protocol...
                String parts[] = source.getFile().split(Pattern.quote("!"));
                source = new URL(parts[0]);
            } catch (MalformedURLException e) {
                return false;
            }
        }
        
        File sourceFile=null;
        if( source.getProtocol().equals("file") ) {
            sourceFile = new File(source.getFile());
        }
        if( sourceFile!=null && sourceFile.exists() ) {
            if( sourceFile.lastModified() > target.lastModified() ) {
                return true;
        return false;
Fixed code: import java.io.*;
import java.util.Random;

            String []libNameParts = map(libName).split("\\.");
            String prefix = libNameParts[0]+"-";
            String suffix = "."+libNameParts[1];

                File target = extract(errors, resource, prefix, suffix, file(customPath));
                if( target!=null ) {
            File target = extract(errors, resource, prefix, suffix, file(customPath));
            if( target!=null ) {
    private File extract(ArrayList<String> errors, URL source, String prefix, String suffix, File directory) {
        File target = null;
            FileOutputStream os = null;
            InputStream is = null;
            try {
                target = File.createTempFile(prefix, suffix, directory);
                target.deleteOnExit();
                return target;
            } finally {
                close(os);
                close(is);
            if( target!=null ) {
            }
        return null;
    static private void close(Closeable file) {
        if(file!=null) {
                file.close();
            } catch (Exception ignore) {