CVE-2018-25068 (published 2023-01-06T21:15Z)

A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the file globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 is able to address this issue. The patch is identified as 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/devent/globalpom-utils
commit_details: repo_url: https://github.com/devent/globalpom-utils
author: Erwin Müller
author_date: 2018-10-10 12:02:07+02:00
msg: Feature #4100 Fix critical Vulnerability

"File.createTempFile" should not be used to create a directory
repository: repo_url: https://github.com/devent/globalpom-utils
repo_name: devent/globalpom-utils
repo_language: Java
owner: devent
file_changes: filename: FileResourceManagerProvider.java
change_type: ModificationType.MODIFY
diff: @@ -1,18 +1,3 @@
-/*
- * Copyright 2016 Erwin Müller <erwin.mueller@deventm.org>
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
 package com.anrisoftware.globalpom.fileresourcemanager;
 
 /*-
@@ -24,9 +9,9 @@ package com.anrisoftware.globalpom.fileresourcemanager;
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -39,6 +24,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.nio.file.Files;
 
 import javax.inject.Inject;
 
@@ -51,77 +37,70 @@ import com.google.inject.Provider;
 /**
  * Provides the file resource manager for ACID file operations. The store
  * directory must be set before creating the manager.
- * 
+ *
  * @author Erwin Mueller, erwin.mueller@deventm.org
  * @since 1.8
  */
-public class FileResourceManagerProvider implements
-		Provider<FileResourceManager> {
+public class FileResourceManagerProvider implements Provider<FileResourceManager> {
 
-	@Inject
-	private FileResourceManagerProviderLogger log;
+    @Inject
+    private FileResourceManagerProviderLogger log;
 
-	private String storeDir;
+    private String storeDir;
 
-	private boolean debug;
+    private boolean debug;
 
-	/**
-	 * Sets debug enabled for the file resource manager.
-	 * 
-	 * @param debug
-	 *            set to {@code true} to enable debug before creating the
-	 *            manager.
-	 */
-	public void setDebug(boolean debug) {
-		this.debug = debug;
-	}
+    /**
+     * Sets debug enabled for the file resource manager.
+     *
+     * @param debug set to {@code true} to enable debug before creating the manager.
+     */
+    public void setDebug(boolean debug) {
+        this.debug = debug;
+    }
 
-	/**
-	 * Sets the store directory path for the file resource manager.
-	 * 
-	 * @param path
-	 *            the store directory {@link File} path.
-	 */
-	public void setStoreDir(File path) {
-		setStoreDir(path.getAbsolutePath());
-	}
+    /**
+     * Sets the store directory path for the file resource manager.
+     *
+     * @param path the store directory {@link File} path.
+     */
+    public void setStoreDir(File path) {
+        setStoreDir(path.getAbsolutePath());
+    }
 
-	/**
-	 * Sets the store directory path for the file resource manager.
-	 * 
-	 * @param path
-	 *            the store directory path.
-	 */
-	public void setStoreDir(String path) {
-		this.storeDir = path;
-	}
+    /**
+     * Sets the store directory path for the file resource manager.
+     *
+     * @param path the store directory path.
+     */
+    public void setStoreDir(String path) {
+        this.storeDir = path;
+    }
 
-	@Override
-	public FileResourceManager get() {
-		String workDir = createTmpDir();
-		boolean urlEncodePath = false;
-		final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
-		PrintWriter printWriter = new PrintWriter(stream) {
-			@Override
-			public void flush() {
-				super.flush();
-				log.logFileResourceMessage(stream.toString());
-			}
-		};
-		LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
-		return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
-	}
+    @Override
+    public FileResourceManager get() {
+        String workDir = createTmpDir();
+        boolean urlEncodePath = false;
+        final ByteArrayOutputStream stream = new ByteArrayOutputStream(1024);
+        PrintWriter printWriter = new PrintWriter(stream) {
+            @Override
+            public void flush() {
+                super.flush();
+                log.logFileResourceMessage(stream.toString());
+            }
+        };
+        LoggerFacade logger = new PrintWriterLogger(printWriter, "", debug);
+        return new FileResourceManager(storeDir, workDir, urlEncodePath, logger);
+    }
 
-	private String createTmpDir() {
-		try {
-			File tmp = File.createTempFile("fileresourcemanager", null);
-			tmp.delete();
-			tmp.mkdir();
-			String workDir = tmp.getAbsolutePath();
-			return workDir;
-		} catch (IOException e) {
-			throw log.errorCreateWorkDir(e);
-		}
-	}
+    private String createTmpDir() {
+        try {
+            File tmp = Files.createTempDirectory("fileresourcemanager").toFile();
+            String workDir = tmp.getAbsolutePath();
+            return workDir;
+        } catch (IOException e) {
+            throw log.errorCreateWorkDir(e);
+        }
+    }
 
 }

programming_language: Java