Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775)
From: Solar Designer <solar () openwall com>
Date: Mon, 25 Jul 2011 06:08:27 +0400

Hi,

I know I am being a year late to comment on this, but maybe better late
than never.  I'll over-quote a little bit:

On Wed, Jun 02, 2010 at 01:43:03PM +0200, Jan Lieskovsky wrote:
   Matt McCutchen pointed out a deficiency in the way rpm handled rpm 
   package upgrades --
it failed to clear out the SUID/SGID bits of the old file by file 
replacement when privileged
user performed package upgrade. Under certain circumstances, a local, 
authenticated user could
use this flaw to escalate their privileges.

Red Hat Bugzilla entry:
  [1] https://bugzilla.redhat.com/show_bug.cgi?id=598775

Upstream changeset:
  [2] 
  http://rpm.org/gitweb?p=rpm.git;a=commit;h=ca2d6b2b484f1501eafdde02e1688409340d2383

Could you allocate CVE id for this?

This was assigned CVE-2010-2059.  And there was a similar issue 5 years
earlier, affecting package removals (rather than upgrades):

https://bugzilla.redhat.com/show_bug.cgi?id=125517

That one was assigned CVE-2005-4889.

The descriptions and fixes for these were limited to SUID/SGID bits and
fscaps (on RPM versions/builds supporting those).  However, what about
device files, maybe with unsafe permissions (or just extra device files
that would need to be gone on package removal or on upgrade to a package
version no longer providing those)?  What about regular files with world
or group write permissions, which allow for a quota bypass?

Additionally, the fix for SUID/SGID bits ignores the return value from
chmod(), so it is fail-open.  It would not even print an error message.
It is unclear what the best action on a partially-failed old package
removal would be, but at the very least we can print an error message.

Sure, these are relatively minor issues, yet if we're fixing things, we
could as well fix them more fully.

What I am considering is chmod()'ing everything but symlinks to 0, as
opposed to the current fix of removing SUID/SGID bits off regular files
with those bits set only.

I've attached a patch against rpm 4.2 (yes, ancient code), which passed
my basic tests (but more testing is needed).

I don't care to request a third CVE id for this; I merely want to
include a better fix.

I'd appreciate any comments.

Thanks,

Alexander

Attachment: rpm-4.2-owl-remove-unsafe-perms.diff
Description:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault