[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Apr 2015 21:10:59 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Problems in automatic crash analysis frameworks
On 04/17/2015 09:16 PM, Florian Weimer wrote:
> A quick update on the abrt situation.
Another update. We now have a public tracking bug listing the issues:
<https://bugzilla.redhat.com/show_bug.cgi?id=1214172>
Previously, all the bugs were public, but it was difficult to find them.
The main fix is to switch problem directory ownership to root:abrt, and
move the directory tree back to /var/spool/abrt, where it was in Red Hat
Enterprise Linux 6. This should make it impossible to exploit the race
conditions in the libreport event handling scripts:
<https://bugzilla.redhat.com/show_bug.cgi?id=1213408>
The other abrt-hook-ccpp fixes are still needed, though.
The problem report directory handling code in libreport is racy, in part
by design. This should be fixed by the changed problem directory
ownership, so we did not assign a separate CVE ID for this.
<https://bugzilla.redhat.com/show_bug.cgi?id=1214745>
There appear to be some buffer overflow/stack overflow issues in the
problem directory code in libreport. With the problem directory
permission changes, this should no longer cross a trust boundary.
<https://bugzilla.redhat.com/show_bug.cgi?id=1214749>
In addition, we have identified several issues in abrt-dbus.
The ChownProblemDir, DeleteElement, and DeleteProblem methods can be
abused to modified unintended parts of the file system because of
missing input validation on the problem directory argument to those
D-Bus method calls. For ChownProblemDir, this will allow privilege
escalation to root. CVE-2015-3150:
<https://bugzilla.redhat.com/show_bug.cgi?id=1214451>
The NewProblem, GetInfo and SetElement methods have directory traversal
vulnerabilities which allow local attackers to read and write arbitrary
files on the system. For NewProblem, it's the analyzer name which is
folded into a path, unchecked; GetInfo and SetElement do not check the
file name in the problem report directory. CVE-2015-3151:
<https://bugzilla.redhat.com/show_bug.cgi?id=1214451>
I'm still unsure about the libreport event handling scripts. Some of
them are clearly supposed to run with a user environment because they
reference files such as ~/.vimrc. I have not figured out yet how this
mechanism is supposed to work.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
