Date: Thu, 30 Apr 2020 13:21:43 +0200 From: Johannes Segitz <jsegitz@...e.de> To: oss-security@...ts.openwall.com Subject: Check your pre/post install scripts in rpm/deb/... packages for security issues Hi, rpm packages can have %post/%pre ... scripts to run code at various points during the installation of a package. Debian packages have a similar mechanism with preinst, postinst, ... Probably all packaging formats provide something like this. The SUSE security team got a hint about an unfortunate construct in a %post script in one of our packages. We found several issues and decided to have a look at our other packages. That resulted in 13 CVEs and 18 non-CVE issues (mostly hardening). Most of these issues result from root operating in user controlled directories. A lot of packages use these scripts to fix up permission problems and introduce problems like $ chown $unpriv_user:$unpriv_group /foo/bar/attackercontrolled/file which can be easily exploited into LPE. Sometimes the attacker needs to win a race, which is (apart from the fact that you need to wait until the package is updated) easily won since shell scripts are slow. We now monitor all changes to these scripts to prevent further issues from sneaking into the distribution and recommend that other distributions check their existing packages and create processes to monitor changes to these scripts. It's way too easy to shoot yourself in the foot and a lot of packagers are not aware of the dangers. In the long term we want to try if something like https://github.com/google/path-auditor can be used to automatically find these issues in our build systems. If you have measures in place to check for problems like these we would be interested to hear about them. Johannes -- GPG Key E7C81FA0 EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0 Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66 SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg Geschäftsführer: Felix Imendörffer (HRB 36809, AG Nürnberg) Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.