357839 - /tmp/.pip_p12tmp prevents other users from importing ssl certificates

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[Florian Streck]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; de; rv:1.8.0.7) Gecko/20060830 Firefox/1.5.0.7 (Debian-1.5.dfsg+1.5.0.7-1)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; de; rv:1.8.0.7) Gecko/20060830 Firefox/1.5.0.7 (Debian-1.5.dfsg+1.5.0.7-1)

The file "/tmp/.pip_p12tmp" is created when clicking "ok" after entering the pass-phrase when you import a SSL-Certificate (pkcs12).
If the passphrase was wrong the file remains in place.
It is only removed when the correct passphrase is entered.
If the user just exits firefox or simply doesn't try it again (sucessfully) the file remains.
On multi-user systems this file prevents other users from importing certificates since the file belongs to the user and has permissions set to -rw-------

Reproducible: Always

Steps to Reproduce:
1. import a SSL-Certificate (pkcs12) and enter wrong passphrase, then click "ok"
2. the file /tmp/.pip_p12tmp exists and belongs to the user that tried to import
   the certificate
3. try, as a second user to import a SSL-Certificate.
Actual Results:  
The second user won't be able to import a Certificate. The Error Message hints to a corrupted certificate-file or a wrong passphrase, which in this case is both is missleading.

Expected Results:  
The file "/tmp/.pip_p12tmp" should have a "unique" name.
And/Or it should have been deleted right after checking if the passphrase was right or wrong.


This was also observed with different Versions of Firefox and Mozilla on Solaris 9 and Solaris 10.

Comment 1

[Steve England [:stevee]]

Reporter, do you still see this problem with the latest Firefox 2? If not, can you please close this bug as WORKSFORME. Thanks!

Comment 2

[Florian Streck]

Problem seems to be resolved with version 2.

Thanks for your work!