[Bug 40274] New: insecure use of /tmp

https://bugs.winehq.org/show_bug.cgi?id=40274

Bug ID: 40274
           Summary: insecure use of /tmp
           Product: Wine
           Version: 1.9.4
          Hardware: x86
               URL: https://bugs.debian.org/816034
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hi,

https://bugs.debian.org/816034:
"wine uses /tmp/.wine-$UID as a directory for sockets and lock files. 
This is insecure. Malicious local user could create /tmp/.wine-$UID for 
another user's uid, preventing the other user from using wine.

Moreover, the server_connect() function doesn't check if /tmp/.wine-$UID 
or its subdirectories are symlinks, so in some circumstances it might be 
possible to trick wine to connect to an unrelated socket."

I'm not sure how to handle this best. I guess at least a link check should be
implemented.

Further if I read dlls/ntdll/server.c correctly the wineserver refuses to setup
the configuration dir if /tmp/.wine-$UID is owned by someone else. But I'm not
sure if this prevents using an already existing /tmp/.wine-$UID owned by
someone else.

Greets
jre

[Bug 40274] insecure use of /tmp

https://bugs.winehq.org/show_bug.cgi?id=40274

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 40274] insecure use of /tmp

https://bugs.winehq.org/show_bug.cgi?id=40274

Sebastian Lackner  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |[e-mail]
         Resolution|---                         |DUPLICATE

--- Comment #1 from Sebastian Lackner  ---
The security risk is relatively small, but the possibility to block other users
from using Wine could indeed be considered a bug. Nevertheless, this is very
similar to bug 39013, so marking as duplicate. This bug report also contains
further discussions why changing this path to a different location is
problematic.

*** This bug has been marked as a duplicate of bug 39013 ***

[Bug 40274] insecure use of /tmp

https://bugs.winehq.org/show_bug.cgi?id=40274

Bruno Jesus  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #2 from Bruno Jesus  ---
Closing duplicate bugs.