...
File identification is less of an issue if applications maintain their files in secure directories, where they can only be accessed by the owner of the file and (possibly) by a system administrator (see FIO15-AC. Ensure that file operations are performed in a secure directory).
...
Noncompliant Code Example (Reopen)
The following non-compliant noncompliant code example opens a file for writing, closes it, opens the same named file for reading, and then closes it again. The logic relies solely on the file name to identify the file.
...
There is no guarantee that the file opened for reading is the same file that is opened for writing. An attacker can replace the original file (for example, with a symbolic link) between the first fclose() and the second fopen().
Compliant Solution (POSIX) (device / i-node)
Reopening a file stream should generally be avoided. However, this may sometimes be necessary in long running applications to avoid depleting available file descriptors.
...
This compliant solution may not work in some cases. For instance a long-running service might choose to occasionally re-open a log file to add log messages, but leave the file closed, so that the log file may be periodically rotated. In this case, the inode number would change, and this solution would no longer apply.
Compliant Solution (POSIX) (open only once)
A simpler solution is to simply not re-open the file. In this code example, the file is opened once for both writing and reading. Once writing is complete, the fseek() function resets the file pointer to the beginning of the file, and its contents are read back (see FIO07-AC. Prefer fseek() to rewind()).
...
Be sure to use fflush() after writing data to the file, in accordance with FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call.
...
Noncompliant Code Example (owner)
In this non-compliant noncompliant code example, the programmer's intent is to open a file for reading, but only if the user running the process owns the specified file. This is a more restrictive requirement that that imposed by the operating system, which only requires that the effective user have permissions to read the file. The code, however, relies solely on the file name to identify the file.
...
If this code is run with superuser privileges, for example, as part of a setuid-root program, an attacker can exploit this program to read files for which the real user normally lacks sufficient privileges, including files not owned by the user.
Compliant Solution (POSIX) (owner)
In this compliant solution, the file is opened using the open() function. If the file is successfully opened, the fstat() function is used to read information about the file into the stat structure. This information is compared with existing information about the real user (obtained by the getuid() and getgid() functions.)
...
Alternatively, the same solution can be implemented using the C99 fopen() function to open the file and the POSIX fileno() function to convert the FILE object pointer to a file descriptor.
Risk Assessment
Many file-related vulnerabilities are exploited to cause a program to access an unintended file. Proper identification of a file is necessary to prevent exploitation.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FIO05-A C | medium | probable | medium | P8 | L2 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Drepper 06|AA. C References#Drepper 06]\] Section 2.2.1 "Identification When Opening" \[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.3, "Files," and Section 7.19.4, "Operations on Files" \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "EWR Path Traversal" \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 37|http://cwe.mitre.org/data/definitions/37.html], "Path Issue - Slash Absolute Path"; [CWE ID 38|http://cwe.mitre.org/data/definitions/38.html], "Path Issue - Backslash Absolute Path"; [CWE ID 39|http://cwe.mitre.org/data/definitions/39.html], "Path Issue - Drive Letter or Windows Volume"; [CWE ID 62|http://cwe.mitre.org/data/definitions/62.html], "UNIX Hard Link"; [CWE ID 64|http://cwe.mitre.org/data/definitions/64.html], "Windows Shortcut Following (.LNK)"; [CWE ID 65|http://cwe.mitre.org/data/definitions/65.html], "Windows Hard Link" \[[Open Group 04|AA. C References#Open Group 04]\] "The open function," "The fstat function" \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 7, "File I/O" |
...
FIO04-C. Detect and handle input and output errors 09. Input Output (FIO) FIO06-A. Create files with appropriate access permissions