Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: temporary file issue in Passenger rubygem
From: cve-assign () mitre org
Date: Thu, 30 Jan 2014 09:26:33 -0500 (EST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If a local attacker can predict this filename, and precreates a
symlink with the same filename that points to an arbitrary directory
with mode 755, owner root and group root, then the attacker will
succeed in making Phusion Passenger write files and create
subdirectories inside that target directory.

It is fixed in upstream version 4.0.33.

https://github.com/phusion/passenger/commit/34b1087870c2bf85ebfd72c30b78577e10ab9744

One thing to notice, however, is that there's a race condition between
the stat check introduced in 34b1087870c2.
The following sequence still triggers the bogus behaviour:

<user> mkdir $dir
<phusion> lstat() (getFileTypeNoFollowSymlinks)
<user> rmdir $dir
<user> ln -s /target $dir
<phusion> stat() (from verifyDirectoryPermissions)

Upstream has now fixed this with the following commit (basically using
the structure from lstat() for the two checks):
https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0

Use CVE-2014-1831 for the vulnerability with the "before 4.0.33"
affected versions.

Use CVE-2014-1832 for the vulnerability with the "4.0.33 and earlier"
affected versions.

This is an unusual situation because it depends on a decision about
whether the fix in version 4.0.33 solves part of the problem or
addresses one of the threat models. It also depends on whether two
CVEs should be used to cover a set of reports that are only relevant
to symlink attacks, but arguably have different flaw types.

CVE-2014-1831 requires the ability to create a symlink but apparently
does not require the ability to conduct the described race-condition
attack. The attacker could lack direct shell access, but have some
type of slow or limited access to the system. This could potentially
involve the ability to upload and run scripts that can create symlinks
but can't execute arbitrary commands or code. Alternatively, the
attacker could have access to a file manager with the same
constraints.

Also, in some cases, multiple CVEs are used in the case of a single
original report of a symlink-handling problem, e.g., CVE-2008-1569 and
CVE-2008-1570.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJS6l9uAAoJEKllVAevmvmsj9oH/RlmH2kO7M1WIIvuD3FlH1SD
Fe0bqmWlVQRR77Q61IS7trfCd88sSTiyWZAm7g8EJn6Prct6AGAIH1tE0EaPbzm1
VrCcxPXJh22LPDNv0p+4ug9CjjWLVhj8cHP/T50M5bgRbbj/EKF4CbkHsDxdLtf8
crpDsvQVTZLS2d2460tCe3gjVk0Ew2bP99PgW0p7NHz4IbbwL2mX/1L0shUqMnkB
UAJW1YSU1n5sAX37iz49Neyw5ptqrXsFcZNvqyuW5ch+LBnMKg8fcgg6t78ATqBE
1bw1HMSPyXhmmajk1ED/+8qc4+wMe0/iqItiVQQTO/JqL3qMGr+1rmGbLkPH43U=
=5HHG
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault