Date: Thu, 23 Apr 2015 21:10:59 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: Problems in automatic crash analysis frameworks On 04/17/2015 09:16 PM, Florian Weimer wrote: > A quick update on the abrt situation. Another update. We now have a public tracking bug listing the issues: <https://bugzilla.redhat.com/show_bug.cgi?id=1214172> Previously, all the bugs were public, but it was difficult to find them. The main fix is to switch problem directory ownership to root:abrt, and move the directory tree back to /var/spool/abrt, where it was in Red Hat Enterprise Linux 6. This should make it impossible to exploit the race conditions in the libreport event handling scripts: <https://bugzilla.redhat.com/show_bug.cgi?id=1213408> The other abrt-hook-ccpp fixes are still needed, though. The problem report directory handling code in libreport is racy, in part by design. This should be fixed by the changed problem directory ownership, so we did not assign a separate CVE ID for this. <https://bugzilla.redhat.com/show_bug.cgi?id=1214745> There appear to be some buffer overflow/stack overflow issues in the problem directory code in libreport. With the problem directory permission changes, this should no longer cross a trust boundary. <https://bugzilla.redhat.com/show_bug.cgi?id=1214749> In addition, we have identified several issues in abrt-dbus. The ChownProblemDir, DeleteElement, and DeleteProblem methods can be abused to modified unintended parts of the file system because of missing input validation on the problem directory argument to those D-Bus method calls. For ChownProblemDir, this will allow privilege escalation to root. CVE-2015-3150: <https://bugzilla.redhat.com/show_bug.cgi?id=1214451> The NewProblem, GetInfo and SetElement methods have directory traversal vulnerabilities which allow local attackers to read and write arbitrary files on the system. For NewProblem, it's the analyzer name which is folded into a path, unchecked; GetInfo and SetElement do not check the file name in the problem report directory. CVE-2015-3151: <https://bugzilla.redhat.com/show_bug.cgi?id=1214451> I'm still unsure about the libreport event handling scripts. Some of them are clearly supposed to run with a user environment because they reference files such as ~/.vimrc. I have not figured out yet how this mechanism is supposed to work. -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.