Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: temporary file issue in Passenger rubygem
From: cve-assign () mitre org
Date: Thu, 30 Jan 2014 09:26:33 -0500 (EST)

Hash: SHA1

If a local attacker can predict this filename, and precreates a
symlink with the same filename that points to an arbitrary directory
with mode 755, owner root and group root, then the attacker will
succeed in making Phusion Passenger write files and create
subdirectories inside that target directory.

It is fixed in upstream version 4.0.33.


One thing to notice, however, is that there's a race condition between
the stat check introduced in 34b1087870c2.
The following sequence still triggers the bogus behaviour:

<user> mkdir $dir
<phusion> lstat() (getFileTypeNoFollowSymlinks)
<user> rmdir $dir
<user> ln -s /target $dir
<phusion> stat() (from verifyDirectoryPermissions)

Upstream has now fixed this with the following commit (basically using
the structure from lstat() for the two checks):

Use CVE-2014-1831 for the vulnerability with the "before 4.0.33"
affected versions.

Use CVE-2014-1832 for the vulnerability with the "4.0.33 and earlier"
affected versions.

This is an unusual situation because it depends on a decision about
whether the fix in version 4.0.33 solves part of the problem or
addresses one of the threat models. It also depends on whether two
CVEs should be used to cover a set of reports that are only relevant
to symlink attacks, but arguably have different flaw types.

CVE-2014-1831 requires the ability to create a symlink but apparently
does not require the ability to conduct the described race-condition
attack. The attacker could lack direct shell access, but have some
type of slow or limited access to the system. This could potentially
involve the ability to upload and run scripts that can create symlinks
but can't execute arbitrary commands or code. Alternatively, the
attacker could have access to a file manager with the same

Also, in some cases, multiple CVEs are used in the case of a single
original report of a symlink-handling problem, e.g., CVE-2008-1569 and

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
Version: GnuPG v1.4.14 (SunOS)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]