| Summary: | Isodumper creates a root owned log in users /home - potential security issue | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | claire robinson <eeeemail> |
| Component: | RPM Packages | Assignee: | papoteur <yvesbrungard> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | critical | ||
| Priority: | Normal | CC: | geiger.david68210, luigiwalser |
| Version: | 4 | ||
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| Whiteboard: | MGA3TOO | ||
| Source RPM: | isodumper | CVE: | |
| Status comment: | |||
| Bug Depends on: | 12702 | ||
| Bug Blocks: | |||
|
Description
claire robinson
2014-10-01 17:04:53 CEST
The file is actually overwritten as soon as isodumper is started.
claire robinson
2014-10-01 17:08:02 CEST
CC:
(none) =>
luigiwalser
claire robinson
2014-10-01 17:08:36 CEST
Whiteboard:
(none) =>
MGA3TOO Sorry Daniel. Assigned incorrectly to you. Assignee:
napcok =>
yves.brungard_mageia On Mageia 4 and newer, you will see that this only works if the file you're pointing at is also owned by you. If it's the real /etc/passwd owned by root (or anything else owned by someone else) the kernel has protection against this type of issue. This issue may be valid in Mageia 3, but we have an update in progress there already. Status:
NEW =>
RESOLVED The test n comment 0 was performed on Mga4. Status:
RESOLVED =>
REOPENED # cat /proc/sys/fs/protected_symlinks 1 Do you get something different? Ahh, your home directory doesn't have the sticky bit set, so this protection fails. Ouch. I guess this is the next wave of security vulnerabilities. It was announced today that SDDM has the same issue. A possible solution would be to store the log elsewhere or save it in /home with the correct attributes or a temporary mitigation may be to timestamp the log file. See: https://bugzilla.suse.com/show_bug.cgi?id=897788 If you chown it afterward, there's a race condition. isodumper needs to drop privileges back to the user account before it creates the log or writes to it. It's been a while since I ran it, but don't you have to put in a root password to give isodumper root privleges? Does it use polkit? I can't remember how this works. polkit, yes. OK, so depending on the configuration it might not require a root password, so this is still bad. The log file is not an important feature. I can write it in /var/log. Or I can suppress it. Have you a preferred option?
papoteur
2014-10-01 22:15:44 CEST
CC:
(none) =>
geiger.david68210 /var/log is the simplest solution I think, however you want to handle it though. Hi, I have a fix, which consists in changing to group and user id before creating the directory and writing the log file. I'm waiting for David_david to package it. Papoteur Is the vulnerability also in Mageia 3?
claire robinson
2014-10-06 12:59:58 CEST
Blocks:
(none) =>
12702
David Walser
2014-10-22 23:07:21 CEST
Blocks:
12702 =>
(none) Hi, A new patch for mga3 and mga4 is now ready for testing !! Was corrected the following issues: - Fix security issue writing log file. Updated packages in core/updates_testing: ======================== isodumper-0.23-1.1.mga3.noarch isodumper-0.23-1.2.mga4.noarch Source RPMs: isodumper-0.23-1.1.mga3.src.rpm isodumper-0.23-1.2.mga4.src.rpm Fixed in http://advisories.mageia.org/MGAA-2014-0187.html Status:
REOPENED =>
RESOLVED |