[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201401301426.s0UEQXJY027363@linus.mitre.org>
Date: Thu, 30 Jan 2014 09:26:33 -0500 (EST)
From: cve-assign@...re.org
To: vdanen@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, geissert@...ian.org,
support@...sion.nl, jwilk@...ian.org, 736958@...s.debian.org
Subject: Re: CVE request: temporary file issue in Passenger rubygem
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> If a local attacker can predict this filename, and precreates a
> symlink with the same filename that points to an arbitrary directory
> with mode 755, owner root and group root, then the attacker will
> succeed in making Phusion Passenger write files and create
> subdirectories inside that target directory.
>
> It is fixed in upstream version 4.0.33.
>
> https://github.com/phusion/passenger/commit/34b1087870c2bf85ebfd72c30b78577e10ab9744
> One thing to notice, however, is that there's a race condition between
> the stat check introduced in 34b1087870c2.
> The following sequence still triggers the bogus behaviour:
>
> <user> mkdir $dir
> <phusion> lstat() (getFileTypeNoFollowSymlinks)
> <user> rmdir $dir
> <user> ln -s /target $dir
> <phusion> stat() (from verifyDirectoryPermissions)
> Upstream has now fixed this with the following commit (basically using
> the structure from lstat() for the two checks):
> https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0
Use CVE-2014-1831 for the vulnerability with the "before 4.0.33"
affected versions.
Use CVE-2014-1832 for the vulnerability with the "4.0.33 and earlier"
affected versions.
This is an unusual situation because it depends on a decision about
whether the fix in version 4.0.33 solves part of the problem or
addresses one of the threat models. It also depends on whether two
CVEs should be used to cover a set of reports that are only relevant
to symlink attacks, but arguably have different flaw types.
CVE-2014-1831 requires the ability to create a symlink but apparently
does not require the ability to conduct the described race-condition
attack. The attacker could lack direct shell access, but have some
type of slow or limited access to the system. This could potentially
involve the ability to upload and run scripts that can create symlinks
but can't execute arbitrary commands or code. Alternatively, the
attacker could have access to a file manager with the same
constraints.
Also, in some cases, multiple CVEs are used in the case of a single
original report of a symlink-handling problem, e.g., CVE-2008-1569 and
CVE-2008-1570.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS6l9uAAoJEKllVAevmvmsj9oH/RlmH2kO7M1WIIvuD3FlH1SD
Fe0bqmWlVQRR77Q61IS7trfCd88sSTiyWZAm7g8EJn6Prct6AGAIH1tE0EaPbzm1
VrCcxPXJh22LPDNv0p+4ug9CjjWLVhj8cHP/T50M5bgRbbj/EKF4CbkHsDxdLtf8
crpDsvQVTZLS2d2460tCe3gjVk0Ew2bP99PgW0p7NHz4IbbwL2mX/1L0shUqMnkB
UAJW1YSU1n5sAX37iz49Neyw5ptqrXsFcZNvqyuW5ch+LBnMKg8fcgg6t78ATqBE
1bw1HMSPyXhmmajk1ED/+8qc4+wMe0/iqItiVQQTO/JqL3qMGr+1rmGbLkPH43U=
=5HHG
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
