oss-security - nilfs-utils privilege escalation

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Fri, 24 Jul 2009 16:37:43 +0200
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Subject: nilfs-utils privilege escalation

Hi!

During the package review of nilfs-utils packages before their
inclusion into Fedora, it was pointed out that upstream Makefiles
install files in /sbin as setuid root:

https://bugzilla.redhat.com/show_bug.cgi?id=505374

Apart from the fact that those utils most likely don't need to be
setuid on normal installs, Steve Grubb also noticed that mkfs.nilfs2
executes external command using system(), making it easy to elevate
privileges.

Issue should be fixed in 2.0.14 released this Mon, with patches linked
in the bug mentioned above.  From a quick look, this should not affect
Debian / Ubuntu packages (thanks to dh_fixperms, it seems), Gentoo does
not seem to have any stable version.  I've not looked at other distros.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.