Security issue with the intermediate staging directory used for DnD and CnP

Problem:
/tmp/VMwareDnD is a staging directory used for DnD and CnP.  It should be
a regular directory, but malicious code or user may create the /tmp/VMwareDnD
 as a symbolic link which points to the home directory of the current desktop
user before the staging directory is created.  Later when the desktop user
initiates a DnD or CnP operation, the permission of that user's home directory
will be changed allowing the malicious user full access to the desktop user's
home directory.

Solution:
Do not set the permission of the staging directory if that directory already
exists and has the wrong permission.  The permission of the directory will
be 1777 if it is created by VMTools.  If that is not the case, the directory
has been created or modified by malicious code or user; just cancel the host
to guest DnD or CnP operation.

diff --git a/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c b/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c
index 708f2a5dc1816f27df6dc7e832babe355c105108..26e2a6adf5909740cae97d61c38e4183af0e7ccb 100644 (file)
--- a/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c
+++ b/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c
@@ -379,12 +379,11 @@ DnDCreateRootStagingDirectory(void)
    }
 
    if (File_Exists(root)) {
-      if (!DnDRootDirUsable(root) &&
-          !DnDSetPermissionsOnRootDir(root)) {
+      if (!DnDRootDirUsable(root)) {
          /*
-          * The directory already exists and its permissions are wrong and
-          * cannot be set, so there's not much we can do.
+          * The directory already exists and its permissions are wrong.
           */
+         Log("%s: The root dir is not usable.\n", __FUNCTION__);
          return NULL;
       }
    } else {

diff --git a/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c b/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c
index 4f52829e70b7c6c9965b9951efc64ba3d0815b14..9a273d645cec46db8f5d2c098f379cbc167ed56d 100644 (file)
--- a/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c
+++ b/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c
@@ -318,12 +318,11 @@ CreateApparentRootDirectory(void)
    }
 
    if (File_Exists(root)) {
-      if (   !DnDRootDirUsable(root)
-          && !DnDSetPermissionsOnRootDir(root)) {
+      if (!DnDRootDirUsable(root)) {
          /*
-          * The directory already exists and its permissions are wrong and
-          * cannot be set, so there's not much we can do.
+          * The directory already exists and its permissions are wrong.
           */
+         Log_Trivia("dnd: The root dir is not usable.\n");
          return NULL;
       }
    } else {