SV.PCC.CONST

Insecure constant temporary filename

If temporary files are created or used insecurely, application and system data can be left open to attack. Dangerous data can be injected into the application, or data stored in the temporary file can be accessed, modified, or corrupted. The SV.PCC.CONST checker flags situations in which a hard-coded name of a Windows temporary file is used in a CreateFile system call.

Vulnerability and risk

Temporary file vulnerability is a very common security issue-the Mitre Corp. security alert database lists over 200 reports of this type. The temporary file vulnerability can be exploited to escalate privilege or manipulate critical information.

Mitigation and prevention

To avoid this vulnerability:

  • Use GetTempPath and GetTempFileName to ensure random name creation
  • Review the least privilege settings for temporary files

Fixed code example

1     //  Gets the temp path env string (no guarantee it's a valid path).
2    dwRetVal = GetTempPath(MAX_PATH,          // length of the buffer
3                           lpTempPathBuffer); // buffer for path 
4    if (dwRetVal > MAX_PATH || (dwRetVal == 0))
5    {
6        PrintError(TEXT("GetTempPath failed"));
7        if (!CloseHandle(hFile))
8        {
9            PrintError(TEXT("CloseHandle(hFile) failed"));
10           return (7);
11       }
12       return (2);
13   }

14   //  Generates a temporary file name. 
15   uRetVal = GetTempFileName(lpTempPathBuffer, // directory for tmp files
16                             TEXT("DEMO"),     // temp file name prefix 
17                             0,                // create unique name 
18                             szTempFileName);  // buffer for name 
19   if (uRetVal == 0)
20   {
21       PrintError(TEXT("GetTempFileName failed"));
22       if (!CloseHandle(hFile))
23       {
24           PrintError(TEXT("CloseHandle(hFile) failed"));
25           return (7);
26       }
27       return (3);
28   }
29   //  Creates the new file to write to for the upper-case version.
30   hTempFile = CreateFile((LPTSTR) szTempFileName, // file name 
31                          GENERIC_WRITE,        // open for write 
32                          0,                    // do not share 
33                          NULL,                 // default security 
34                          CREATE_ALWAYS,        // overwrite existing
35                          FILE_ATTRIBUTE_TEMPORARY, // temporary storage 
36                          NULL);                // no template 
37   if (hTempFile == INVALID_HANDLE_VALUE) 
38   { 
39       PrintError(TEXT("Second CreateFile failed"));
40       if (!CloseHandle(hFile))
41       {
42           PrintError(TEXT("CloseHandle(hFile) failed"));
43           return (7);
44       }
45       return (4);
46   } 

This is an example of code that follows good practices in creating temporary files. With secure temporary filenames, you don't run the risk of leaving the application or system data open to attack.

Security training

Application security training materials provided by Secure Code Warrior.