Date: Thu, 30 Jan 2014 09:26:33 -0500 (EST) From: cve-assign@...re.org To: vdanen@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, geissert@...ian.org, support@...sion.nl, jwilk@...ian.org, 736958@...s.debian.org Subject: Re: CVE request: temporary file issue in Passenger rubygem -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > If a local attacker can predict this filename, and precreates a > symlink with the same filename that points to an arbitrary directory > with mode 755, owner root and group root, then the attacker will > succeed in making Phusion Passenger write files and create > subdirectories inside that target directory. > > It is fixed in upstream version 4.0.33. > > https://github.com/phusion/passenger/commit/34b1087870c2bf85ebfd72c30b78577e10ab9744 > One thing to notice, however, is that there's a race condition between > the stat check introduced in 34b1087870c2. > The following sequence still triggers the bogus behaviour: > > <user> mkdir $dir > <phusion> lstat() (getFileTypeNoFollowSymlinks) > <user> rmdir $dir > <user> ln -s /target $dir > <phusion> stat() (from verifyDirectoryPermissions) > Upstream has now fixed this with the following commit (basically using > the structure from lstat() for the two checks): > https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0 Use CVE-2014-1831 for the vulnerability with the "before 4.0.33" affected versions. Use CVE-2014-1832 for the vulnerability with the "4.0.33 and earlier" affected versions. This is an unusual situation because it depends on a decision about whether the fix in version 4.0.33 solves part of the problem or addresses one of the threat models. It also depends on whether two CVEs should be used to cover a set of reports that are only relevant to symlink attacks, but arguably have different flaw types. CVE-2014-1831 requires the ability to create a symlink but apparently does not require the ability to conduct the described race-condition attack. The attacker could lack direct shell access, but have some type of slow or limited access to the system. This could potentially involve the ability to upload and run scripts that can create symlinks but can't execute arbitrary commands or code. Alternatively, the attacker could have access to a file manager with the same constraints. Also, in some cases, multiple CVEs are used in the case of a single original report of a symlink-handling problem, e.g., CVE-2008-1569 and CVE-2008-1570. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS6l9uAAoJEKllVAevmvmsj9oH/RlmH2kO7M1WIIvuD3FlH1SD Fe0bqmWlVQRR77Q61IS7trfCd88sSTiyWZAm7g8EJn6Prct6AGAIH1tE0EaPbzm1 VrCcxPXJh22LPDNv0p+4ug9CjjWLVhj8cHP/T50M5bgRbbj/EKF4CbkHsDxdLtf8 crpDsvQVTZLS2d2460tCe3gjVk0Ew2bP99PgW0p7NHz4IbbwL2mX/1L0shUqMnkB UAJW1YSU1n5sAX37iz49Neyw5ptqrXsFcZNvqyuW5ch+LBnMKg8fcgg6t78ATqBE 1bw1HMSPyXhmmajk1ED/+8qc4+wMe0/iqItiVQQTO/JqL3qMGr+1rmGbLkPH43U= =5HHG -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ