249651 - File permissions after Firefox 0.9/0.9.1 installation are almost all world-writeable

Status: VERIFIED DUPLICATE of bug 231083

(Firefox :: Installer, defect)

Description

[Max Stoeger]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040207 Firefox/0.8

Since Firefox 0.9 the file permissions after installation/unpacking are
word-writeable on most files. This definitelly is a security hole because
anybody could insert malicious code into any of the binaries.
The problem exists both in the Firefox 0.9 .tar.gz archive as well as in the
Firefox 0.9.1 installer.

Reproducible: Always
Steps to Reproduce:
1. cd into the firefox installation directory
2. type ls -l
3. look at the file permissions

Actual Results:  
someone haxored my butt

Expected Results:  
set safe permissions

Comment 1

[Matthew Foulkes]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)
Gecko/20040207 Firefox/0.8
> Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)
Gecko/20040207 Firefox/0.8
> 
> Since Firefox 0.9 the file permissions after installation/unpacking are
> word-writeable on most files. This definitelly is a security hole because
> anybody could insert malicious code into any of the binaries.
> The problem exists both in the Firefox 0.9 .tar.gz archive as well as in the
> Firefox 0.9.1 installer.
> 
> Reproducible: Always
> Steps to Reproduce:
> 1. cd into the firefox installation directory
> 2. type ls -l
> 3. look at the file permissions
> 
> Actual Results:  
> someone haxored my butt
> 
> Expected Results:  
> set safe permissions

Having just installed Firefox 0.9.1 [Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.7) Gecko/20040626 Firefox/0.9.1] on a Linux system with about 30 users, I
was shocked to find that this bug remains in 0.9.1. By modifying the
world-writeable firefox binaries, an unscrupulous user could trick other users
into running more or less anything.  If the user who unwittingly runs the
modified firefox binary is root, this provides a very simple local root exploit.
Either I have misunderstood something or this is a serious security problem.

Firefox seems to run fine when more sensible permsissions are used.

Comment 2

[Max Stoeger]

Why is this still "unconfirmed"? Anybody home? Or am I really doing something wrong?

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

tar ANDs the permissions with your umask when it extracts files so this isn't a
problem for the tar.gz build.

I think this is basically a duplicate of bug 231803, except the workaround never
landed for Firefox, just Seamonkey.

Comment 4

[Jesse Ruderman]

David meant to link to bug 231083.

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

also see bug 235781

Comment 6

[Brendan Eich [:brendan]]

Per the patch in bug 231083 comment 28, attachment 155043 [details] [diff] [review], this seems like a dup
of 231083.

/be

*** This bug has been marked as a duplicate of 231083 ***

Comment 7

[Matthew Foulkes]

(In reply to comment #6)
> Per the patch in bug 231083 comment 28, attachment 155043 [details] [diff] [review], this seems like a dup
> of 231083.
> 
> /be
> 
> *** This bug has been marked as a duplicate of 231083 ***

Does this mean that the bug in firefox has been/will be fixed? (I cannot check
because I do not have permission to look at the reports for bug 231083.)

I disagree with the earlier comment that the .tar.gz installation is OK. For
example:

# whoami
root
# umask
0022
# tar -zxvf firefox-0.9.1-i686-linux-gtk2+xft.tar.gz
# cd firefox
# ls -l
total 12441
drwxrwxr-x  19 500 500    1008 2004-06-28 06:15 chrome
drwxrwxrwx   3 500 500    4872 2004-06-28 06:15 components
drwxrwxrwx   5 500 500     128 2004-06-27 01:28 defaults
-rwxr-xr-x   1 500 500    4775 2004-06-27 01:15 firefox
-rwxr-xr-x   1 500 500 9816596 2004-06-28 06:15 firefox-bin
drwxrwxrwx   2 500 500     144 2004-06-27 00:44 greprefs
drwxrwxrwx   2 500 500     112 2004-06-27 01:28 icons
drwxrwxrwx   2 500 500      72 2004-06-27 01:29 init.d
-rwxrwxrwx   1 500 500  439568 2004-06-28 06:15 libmozjs.so
-rwxrwxrwx   1 500 500  175264 2004-06-28 06:15 libnspr4.so
-rwxrwxrwx   1 500 500  443224 2004-06-28 06:15 libnss3.so
-rwxrwxrwx   1 500 500  178780 2004-06-28 06:15 libnssckbi.so
-rwxrwxrwx   1 500 500   14704 2004-06-28 06:15 libplc4.so
...          ...           ...

Comment 8

[Jan Ingvoldstad]

(In reply to comment #7)
> Does this mean that the bug in firefox has been/will be fixed?

It certainly hasn't been fixed in 0.9.3.


> (I cannot check
> because I do not have permission to look at the reports for bug 231083.)

Me neither.  But see the discussion in bug 235781.


> I disagree with the earlier comment that the .tar.gz installation is OK. For
> example:

The .tar.gz installation has not been fixed, either.

It *appears* to have been fixed if you unpack the tarball with a non-root
user, though that is just an illusion created by the fact that tar can't
restore the original owner, group and permissions when you're not running
it as root.

So a default firefox-install on Linux remains a gaping security hole.

For now, those of us who insist on using firefox regardless, the fix is
(if the install directory is "firefox", as it is in the installer-less
version):

  find firefox -perm 666 -o -perm 777 |xargs chmod og-w