[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAA7hUgHD7YKjt26+ML=H9KcJoXhx7ONW9sGRF5UpyypDV=uB-A@mail.gmail.com>
Date: Mon, 15 Jul 2013 16:37:29 +0200
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Insecure temp files usage in phusion passenger (other than CVE-2013-2119)
Hi again,
On 10 June 2013 16:54, Raphael Geissert <geissert@...ian.org> wrote:
> While looking at CVE-2013-2119 I noticed that Phusion Passenger
> 2.2.11's ext/common/Utils.cpp makeDirTemp() uses mkdir(1) to create
> directories in /tmp (e.g. /tmp/phusion.$$) for use by the application
> and web server.
> A local user could create the directories and have write access to
> directories, and possibly files used by the application. I haven't
> confirmed, but I guess this would allow some sort of privilege
> escalation to the user executing the application or at least access to
> otherwise restricted data.
>
> Additionally, some of the subdirectories might be chown(2)ed to a
> different user even if the directory already existed (it chowns iff
> mkdir(1) returns 0). Not sure if it could have an impact, however.
After talking to upstream, the above issue with the temp directory has
been fixed in 4.0.6 (release withdrawn and replaced by 4.0.7 due to a
regression), and a regression fixed in 4.0.8[2]. The issue was tracked
as #910[3].
Could a CVE id be assigned then?
It allows a local user to DoS the service or to take over its traffic.
[1]http://blog.phusion.nl/2013/07/04/phusion-passenger-4-0-6-released/
Bug fix: https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b
[2]http://blog.phusion.nl/2013/07/09/phusion-passenger-4-0-8-released/
Regression fix:
https://github.com/phusion/passenger/commit/9dda49f4a3ebe9bafc48da1bd45799f30ce19566
[3]https://code.google.com/p/phusion-passenger/issues/detail?id=910
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
