Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request: cronie fd leak
From: Vincent Danen <vdanen () redhat com>
Date: Wed, 9 Jan 2013 08:46:44 -0700

* [2013-01-09 09:24:23 +0100] Sebastian Krahmer wrote:

Possible that you have got a different cron implementation.

No, we're using cronie as well.

There is no hidden info in our bugzilla; the reproducer
is using lvm commands, but I remember it worked with any
command. Actually its not about the warnings, a "cat" will probably
also do, if you check its /proc/$pid/fd when its invoked.
But cat doesnt emit warnings about open fd's.

Not sure about upstream, probably not.

Ok, so did some more digging based on some info from one of our
developers that we had patched this in Fedora.

Looks like this patch introduced the leak on 2011-04-28:

http://git.fedorahosted.org/cgit/cronie.git/commit/src/cron.c?id=acdf4ae8456888ed78201906ef528f4c28f54582

And this patch reverted it on 2011-06-29:

http://git.fedorahosted.org/cgit/cronie.git/commit/src/cron.c?id=b19007ca9fddd62ecef3af4a7d2d252f1d5e0419

So it looks like only 1.4.8 was affected by this (which, judging by the
patch in your bugzilla is the same version you're seeing as affected).

That might be a better patch to use than what you're using.  Anyways,
this only affects 1.4.8 (for any others using cronie and concerned as to
whether or not they might be affected).

This was also reported to our bugzilla here:

https://bugzilla.redhat.com/show_bug.cgi?id=717505

On Tue, Jan 08, 2013 at 09:01:19PM -0700, Vincent Danen wrote:
* [2013-01-08 13:56:40 +0100] Sebastian Krahmer wrote:

"Hello Kurt, Steve, vendors,"

cronie leaks read-only fd's, please check here:

https://bugzilla.novell.com/show_bug.cgi?id=786096

can someone assign a CVE?

Sebastian, do you have a specific command that you're using?  I'm trying
to reproduce this in Fedora and RHEL using lvdisplay (maybe a bad
choice?) and also using "lvm vgck -v vg_thor && lvm pvs" in
/etc/crontab.

The output is mailed to me fine with no warnings?  Can you share what
command was being used to reproduce this?  It's possible that something
you added (or we added) makes this a non-issue on other platforms.

Has upstream been informed of this yet?

--
Vincent Danen / Red Hat Security Response Team

--

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team


--
Vincent Danen / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault