[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Apr 2020 13:21:43 +0200
From: Johannes Segitz <jsegitz@...e.de>
To: oss-security@...ts.openwall.com
Subject: Check your pre/post install scripts in rpm/deb/... packages for
security issues
Hi,
rpm packages can have %post/%pre ... scripts to run code at various points
during the installation of a package. Debian packages have a similar mechanism
with preinst, postinst, ... Probably all packaging formats provide something
like this.
The SUSE security team got a hint about an unfortunate construct in a %post
script in one of our packages. We found several issues and decided to have a
look at our other packages. That resulted in 13 CVEs and 18 non-CVE issues
(mostly hardening). Most of these issues result from root operating in user
controlled directories. A lot of packages use these scripts to fix up
permission problems and introduce problems like
$ chown $unpriv_user:$unpriv_group /foo/bar/attackercontrolled/file
which can be easily exploited into LPE. Sometimes the attacker needs to win a
race, which is (apart from the fact that you need to wait until the package is
updated) easily won since shell scripts are slow.
We now monitor all changes to these scripts to prevent further issues from
sneaking into the distribution and recommend that other distributions check
their existing packages and create processes to monitor changes to these
scripts. It's way too easy to shoot yourself in the foot and a lot of packagers
are not aware of the dangers.
In the long term we want to try if something like
https://github.com/google/path-auditor
can be used to automatically find these issues in our build systems. If you
have measures in place to check for problems like these we would be interested
to hear about them.
Johannes
--
GPG Key E7C81FA0 EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg
Geschäftsführer: Felix Imendörffer (HRB 36809, AG Nürnberg)
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
