[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAA7hUgG+mofrGa1=BcbUAxw0b_7RagbY9-Tn=fMBXfvOocFywA@mail.gmail.com>
Date: Mon, 10 Jun 2013 16:54:21 +0200
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Insecure temp files usage in phusion passenger (other than CVE-2013-2119)
Hi,
While looking at CVE-2013-2119 I noticed that Phusion Passenger
2.2.11's ext/common/Utils.cpp makeDirTemp() uses mkdir(1) to create
directories in /tmp (e.g. /tmp/phusion.$$) for use by the application
and web server.
A local user could create the directories and have write access to
directories, and possibly files used by the application. I haven't
confirmed, but I guess this would allow some sort of privilege
escalation to the user executing the application or at least access to
otherwise restricted data.
Additionally, some of the subdirectories might be chown(2)ed to a
different user even if the directory already existed (it chowns iff
mkdir(1) returns 0). Not sure if it could have an impact, however.
Later versions of Phusion Passenger (namely, 3.0.13) use mkdir(2)
directly but it only checks for EEXIST, in which case it even skips
the chown. The directory is chmod'ed and chown'ed otherwise.
So, at least in 3.0.13 a file could be created instead of a directory
and the code would go on, while in 2.2.11 one would need to win the
race condition in mkdir(1) -p's stat check.
Does anyone know enough about phusion passenger to know what the
impact could be?
(and depending on that, assigning CVE id(s))
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
