Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: temporary file issue in Passenger rubygem
From: Raphael Geissert <geissert () debian org>
Date: Wed, 29 Jan 2014 09:57:27 +0100


On 29 January 2014 00:23, Vincent Danen <vdanen () redhat com> wrote:
Phusion Passenger creates a "server instance directory" in /tmp during startup,
which is a temporary directory that Phusion Passenger uses to store working files.
This directory is deleted after Phusion Passenger exits. For various technical
reasons, this directory must have a semi-predictable filename. If a local attacker
can predict this filename, and precreates a symlink with the same filename that
points to an arbitrary directory with mode 755, owner root and group root, then
the attacker will succeed in making Phusion Passenger write files and create
subdirectories inside that target directory.

Ah, nice catch Jakub. Needless to say, this is related to but
different from CVE-2013-4136.

One thing to notice, however, is that there's a race condition between
the stat check introduced in 34b1087870c2.
The following sequence still triggers the bogus behaviour:

<user> mkdir $dir
<phusion> lstat() (getFileTypeNoFollowSymlinks)
<user> rmdir $dir
<user> ln -s /target $dir
<phusion> stat() (from verifyDirectoryPermissions)

Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]