Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Jan 2014 09:26:33 -0500 (EST)
Subject: Re: CVE request: temporary file issue in Passenger rubygem

Hash: SHA1

> If a local attacker can predict this filename, and precreates a
> symlink with the same filename that points to an arbitrary directory
> with mode 755, owner root and group root, then the attacker will
> succeed in making Phusion Passenger write files and create
> subdirectories inside that target directory.
> It is fixed in upstream version 4.0.33.

> One thing to notice, however, is that there's a race condition between
> the stat check introduced in 34b1087870c2.
> The following sequence still triggers the bogus behaviour:
> <user> mkdir $dir
> <phusion> lstat() (getFileTypeNoFollowSymlinks)
> <user> rmdir $dir
> <user> ln -s /target $dir
> <phusion> stat() (from verifyDirectoryPermissions)

> Upstream has now fixed this with the following commit (basically using
> the structure from lstat() for the two checks):

Use CVE-2014-1831 for the vulnerability with the "before 4.0.33"
affected versions.

Use CVE-2014-1832 for the vulnerability with the "4.0.33 and earlier"
affected versions.

This is an unusual situation because it depends on a decision about
whether the fix in version 4.0.33 solves part of the problem or
addresses one of the threat models. It also depends on whether two
CVEs should be used to cover a set of reports that are only relevant
to symlink attacks, but arguably have different flaw types.

CVE-2014-1831 requires the ability to create a symlink but apparently
does not require the ability to conduct the described race-condition
attack. The attacker could lack direct shell access, but have some
type of slow or limited access to the system. This could potentially
involve the ability to upload and run scripts that can create symlinks
but can't execute arbitrary commands or code. Alternatively, the
attacker could have access to a file manager with the same

Also, in some cases, multiple CVEs are used in the case of a single
original report of a symlink-handling problem, e.g., CVE-2008-1569 and

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.