oss-security - CVE-2012-5377 through CVE-2012-5383: Windows PATH issues affecting some open-source products

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201210110728.q9B7SoeE029303@linus.mitre.org>
Date: Thu, 11 Oct 2012 03:28:50 -0400 (EDT)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-2012-5377 through CVE-2012-5383: Windows PATH issues affecting some open-source products

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

MITRE assigned seven CVE names for this recent disclosure that
mentions a few open-source products and also other products, but only
when installed on Windows:

  https://www.htbridge.com/advisory/HTB23108

CVE-2012-5377 ActivePerl
CVE-2012-5378 ActiveTcl
CVE-2012-5379 ActivePython
CVE-2012-5380 Ruby
CVE-2012-5381 PHP
CVE-2012-5382 Zend Server
CVE-2012-5383 MySQL

The essence of the problem is that:

  1. Windows has system environment variables, such as PATH, that
     apply to all users.

  2. On Windows, the installation procedure for a product sometimes
     results (through different mechanisms) in a modified PATH that
     references the product's installation directory.

  3. The permissions of the installation directory might be unsafe.

  4. Some other software, including software shipped by Microsoft,
     relies on the PATH containing only safe directories.

One example of an open-source product:

http://www.php.net/manual/en/faq.installation.php#faq.installation.addtopath
says to add C:\php to the PATH, but doesn't suggest checking the
permissions of C:\php before doing this. In this case, the situation
probably should not be described as a vulnerability in the PHP
software. It could perhaps be considered a security-related
documentation issue.

One example of another product:

http://docs.activestate.com/activeperl/5.16/install.html has an
installation option related to PATH:

  PERL_PATH: If set to 'No', the Perl/bin directory will not be added to
  the system PATH environment variable.

and possibly the default is 'Yes' in some or all versions. Here, there
is a better argument that this is a vulnerability in the product,
because (according to the HTB23108 disclosure) the installation
software itself can make an unsafe PATH change.

One possible security guideline is that all products that
automatically modify PATH during installation should be checking all
relevant directory permissions first. This is, however, not the only
possible way to address the underlying problem or problems. It is
currently unclear whether there should be a CVE entry for every
product that handles this PATH issue in any potentially unsafe way.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (SunOS)

iQEcBAEBAgAGBQJQdnQbAAoJEGvefgSNfHMdJgAIAJZfQPOHSY5B+IOWDIHW9468
MYO00QJVxBf0+PgHEPfxu14URbbQw0ZohJm77iaBj0Ur2CfWDE2c9pvw/qupwkS5
40YjixICcuE1jniUoogVmPjrE15LsxQJdo5twWemOVeF/wVmVE03athK/XvR4gCw
ZfquFBIiUgTz6thiVmb+LVlgsRQW0oLm3L9/D/hLoKv0ZMb8KLoti/blqDw43WU9
WDCO0CcSt8nb30NyKyo8kCraJIRAWz+dPyfBSJcv6xHlz6A3fYkRfbaQ6XtAb5JQ
f4qRWWVRLREgf+MxqgFWjEiKBcW083/s+M3QqcKVxGKR+7aZlbiPYPSICMpa+cc=
=8yEd
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.