Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Feb 2014 13:36:33 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: Percona Toolkit automatic version check - remote code
	execution / information leak

Hi,

https://bugs.launchpad.net/percona-toolkit/+bug/1279502
https://bugzilla.novell.com/show_bug.cgi?id=864194

Quoting launchpad we have this gem:
-------------------------------------------------------------------------------
Percona Toolkit 2.1 introduced --version-check to warn user about
known vulnerabilities in the local MySQL instance and to check for PT
updates. When this option is enabled - and it is enabled by default(!) -
various information about local MySQL as well as other system binaries and
packages are submitted to Percona along with the server's IP address. This
not only exposes possibly sensitive information, but also does so without
bringing it to user's attention or asking for their consent.

It gets worse. The configuration for what information PT tools should
collect is not hardcoded in the scripts. Instead, every time it's
downloaded from http://v.percona.com/. One of the possible parameters
is a binary file name to be executed, i.e. Percona can remotely execute
arbitrary command - again, without making user aware of what or when
is being executed. To be fair, the ability to run commands is limited
to running "command -v", however that's only under the assumption that
the command filters will always work. The configuration can also ask
for any MySQL variable - not just the version string.

In my opinion --version-check should never be enabled by default and
if user wants to keep it enabled, the configuration (i.e. the list of
checks) should be hardcoded and explicitly listed, and not downloaded
from a remote location.

Current workaround: To avoid confidential information being exposed,
always use --no-version-check with every PT tool that includes
'version-check' feature (e.g. pt-query-digest, pt-diskstats).
-------------------------------------------------------------------------------

Basically it is not just information leakage, but remote code execution if
you can overtake the v.percona.com host or just be man in the middle.

Ciao, Marcus

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ