Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775)

[Josh Bressers <bressers () redhat com>]

----- "Jan Lieskovsky" <jlieskov () redhat com> wrote:

> Jan Lieskovsky wrote:
> > Hi Steve, vendors,
> >
> >    Matt McCutchen pointed out a deficiency in the way rpm handled rpm
> >    package upgrades -- it failed to clear out the SUID/SGID bits of the
> >    old file by file replacement when privileged user performed package
> >    upgrade. Under certain circumstances, a local, authenticated user
> >    could use this flaw to escalate their privileges.
>
> Maybe obvious and natural conclusion from previous post already, but Panu
> clarified yet, similar deficiency holds for dealing with posix file
> capabilities and SELinux contexts, i.e. they are not cleared after pkg
> upgrade. Not sure second CVE is needed for this, but if one is enough,
> wanted to explicitly mention this, so it can be described in the text of
> the CVE too.

I'm going to give both of these the same CVE id. The issues are very
related, and I had look at the CWE guide, they both seem to fall under
"CWE-281: Improper Preservation of Permissions"

Steve, feel free to overrule me on this one.

CVE-2010-2059

Thanks.

-- 
    JB