Date: Thu, 23 Jan 2014 16:46:54 -0700 From: "Vincent Danen" <vdanen@...hat.com> To: "OSS Security List" <oss-security@...ts.openwall.com> Subject: CVE-2014-0022 insecure install of rpm packages via yum cron Just wanted to give a heads up of a flaw that was reported to our bugzilla. Our primary bug on this is here: https://bugzilla.redhat.com/show_bug.cgi?id=1057377 I'm just going to cut-n-paste what I wrote in the bug. Obviously no CVE needs to be assigned; this is for others who may be shipping yum. Gabriel VLASIU reported  that yum-cron would install unsigned RPM packages that yum itself would refuse to install. The yum-cron code is based on that in yum-updatesd.py. This is due to the installUpdates() function (processPkgs() in yum-updatesd.py) failing to fully check the return code of the called sigCheckPkg() function. sigCheckPkg() is described thus: def sigCheckPkg(self, po): """Verify the GPG signature of the given package object. :param po: the package object to verify the signature of :return: (result, error_string) where result is:: 0 = GPG signature verifies ok or verification is not required. 1 = GPG verification failed but installation of the right GPG key might help. 2 = Fatal GPG verification error, give up. """ However, the processPkgs() and installUpdates() calling function do not account for return code 2: def processPkgs(self, dlpkgs): ... for po in dlpkgs: result, err = self.updd.sigCheckPkg(po) if result == 0: continue elif result == 1: try: self.updd.getKeyForPackage(po) except yum.Errors.YumBaseError, errmsg: self.failed([str(errmsg)]) and: def installUpdates(self, emit): ... for po in dlpkgs: result, err = self.sigCheckPkg(po) if result == 0: continue elif result == 1: try: self.getKeyForPackage(po) except yum.Errors.YumBaseError, errmsg: self.emitUpdateFailed(errmsg) return False yum-cron.py replaced yum-cron.sh in Fedora 19 (3.4.3-47); earlier versions of Fedora use yum-updatesd. This has been corrected upstream  and in Fedora via yum-3.4.3-132.fc19 and yum-3.4.3-130.fc20. This does not affect Red Hat Enterprise Linux 6 as it used neither yum-updatesd nor yum-cron; it used a shellscript that called yum itself to do updates.  https://bugzilla.redhat.com/show_bug.cgi?id=1052440  http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=9df69e579496ccb6df5c3f5b5b7bab8d648b06b4 -- Vincent Danen / Red Hat Security Response Team Download attachment "signature.asc" of type "application/pgp-signature" (711 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.