Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Jan 2015 21:12:03 +0100
From: Helmut Grohne <helmut@...divi.de>
To: oss-security@...ts.openwall.com
Cc: Victor Seva <linuxmaniac@...reviejawireless.org>
Subject: kamailio: multiple /tmp file vulnerabilities

Hi,

There are multiple /tmp file vulnerabilities to be found in the kamailio
SIP proxy. While many of these issues only affect configuration examples
or outdated components, some do affect the default configuration.

Initial disclosures:
 http://bugs.debian.org/712083 (2013)
 http://bugs.debian.org/775681 (2015)
Upstream issue:
 https://github.com/kamailio/kamailio/issues/48

At this point, three issues are well understood:
 * The kamctl administrative utility and default configuration would use
   /tmp/kamailio_fifo (#712083, 2013, fixed in Debian's kamailio
   4.0.2-1).
 * The kamcmd administrative utility and default configuration would use
   /tmp/kamailio_ctl (#775681, 2015, patch available).
 * The kamailio build process would use constant filenames in /tmp
   allowing to elevate privileges to the build user (#775681, 2015,
   patch available).

The combined patch can be found at:
https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=17;filename=0001-fix-fifo-and-ctl-defaults-pointing-to-unsecure-tmp-d.patch;att=1;bug=775681

While the last issue definitely affects the upstream kamailio build,
arguably the first two issues are packaging specific. If they are
treated as such, it is worth noting that kamailio was never part of a
Debian stable release and thus this may not be worth issuing a CVE.

I would like to thank Victor Seva for his timely responses, kind
interaction and providing patches for all of these issues.

Helmut

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ