oss-sec mailing list archives
Re: Problems in automatic crash analysis frameworks
From: Florian Weimer <fweimer () redhat com>
Date: Thu, 23 Apr 2015 21:10:59 +0200
On 04/17/2015 09:16 PM, Florian Weimer wrote:
A quick update on the abrt situation.
Another update. We now have a public tracking bug listing the issues: <https://bugzilla.redhat.com/show_bug.cgi?id=1214172> Previously, all the bugs were public, but it was difficult to find them. The main fix is to switch problem directory ownership to root:abrt, and move the directory tree back to /var/spool/abrt, where it was in Red Hat Enterprise Linux 6. This should make it impossible to exploit the race conditions in the libreport event handling scripts: <https://bugzilla.redhat.com/show_bug.cgi?id=1213408> The other abrt-hook-ccpp fixes are still needed, though. The problem report directory handling code in libreport is racy, in part by design. This should be fixed by the changed problem directory ownership, so we did not assign a separate CVE ID for this. <https://bugzilla.redhat.com/show_bug.cgi?id=1214745> There appear to be some buffer overflow/stack overflow issues in the problem directory code in libreport. With the problem directory permission changes, this should no longer cross a trust boundary. <https://bugzilla.redhat.com/show_bug.cgi?id=1214749> In addition, we have identified several issues in abrt-dbus. The ChownProblemDir, DeleteElement, and DeleteProblem methods can be abused to modified unintended parts of the file system because of missing input validation on the problem directory argument to those D-Bus method calls. For ChownProblemDir, this will allow privilege escalation to root. CVE-2015-3150: <https://bugzilla.redhat.com/show_bug.cgi?id=1214451> The NewProblem, GetInfo and SetElement methods have directory traversal vulnerabilities which allow local attackers to read and write arbitrary files on the system. For NewProblem, it's the analyzer name which is folded into a path, unchecked; GetInfo and SetElement do not check the file name in the problem report directory. CVE-2015-3151: <https://bugzilla.redhat.com/show_bug.cgi?id=1214451> I'm still unsure about the libreport event handling scripts. Some of them are clearly supposed to run with a user environment because they reference files such as ~/.vimrc. I have not figured out yet how this mechanism is supposed to work. -- Florian Weimer / Red Hat Product Security
Current thread:
- Re: Problems in automatic crash analysis frameworks, (continued)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 15)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 15)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks cve-assign (Apr 16)
- Re: Re: Problems in automatic crash analysis frameworks Huzaifa Sidhpurwala (Apr 15)
- Re: Problems in automatic crash analysis frameworks Grandma Eubanks (Apr 17)
- Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 17)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 17)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (Apr 23)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (May 05)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (May 05)
- Re: Problems in automatic crash analysis frameworks Florian Weimer (May 05)
- Re: Problems in automatic crash analysis frameworks Tavis Ormandy (May 05)
- Re: Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)
- Re: Re: Problems in automatic crash analysis frameworks Tavis Ormandy (Apr 15)