From ${URL} : On 10 June 2013 16:54, Raphael Geissert <geissert@...ian.org> wrote: > While looking at CVE-2013-2119 I noticed that Phusion Passenger > 2.2.11's ext/common/Utils.cpp makeDirTemp() uses mkdir(1) to create > directories in /tmp (e.g. /tmp/phusion.$$) for use by the application > and web server. > A local user could create the directories and have write access to > directories, and possibly files used by the application. I haven't > confirmed, but I guess this would allow some sort of privilege > escalation to the user executing the application or at least access to > otherwise restricted data. > > Additionally, some of the subdirectories might be chown(2)ed to a > different user even if the directory already existed (it chowns iff > mkdir(1) returns 0). Not sure if it could have an impact, however. After talking to upstream, the above issue with the temp directory has been fixed in 4.0.6 (release withdrawn and replaced by 4.0.7 due to a regression), and a regression fixed in 4.0.8[2]. The issue was tracked as #910[3]. Could a CVE id be assigned then? It allows a local user to DoS the service or to take over its traffic. [1]http://blog.phusion.nl/2013/07/04/phusion-passenger-4-0-6-released/ Bug fix: https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b [2]http://blog.phusion.nl/2013/07/09/phusion-passenger-4-0-8-released/ Regression fix: https://github.com/phusion/passenger/commit/9dda49f4a3ebe9bafc48da1bd45799f30ce19566 [3]https://code.google.com/p/phusion-passenger/issues/detail?id=910 @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
passenger-4.x has a lot of packaging issues (I've already been working on it in the past weeks), and we certainly can't just stable it for our current users due to all the changes involved. It's not clear to me that passenger-3.x is involved, but if it is then these fixes should be backported, preferably by upstream.
All right, we'll wait and see whether this affects 2/3. If you could poke upstream about this, that would be helpful.
Passenger 4.0.10 has now been added to the tree, but this version needs significant testing before it can be a stable candidate.
(In reply to Hans de Graaff from comment #3) > Passenger 4.0.10 has now been added to the tree, but this version needs > significant testing before it can be a stable candidate. How are we with testing 4.0.10? Alternatively, the Red Hat bug in see also contains a patch to backport to 3.0.21.
I've just added passenger 4.0.18 which has bug fixes compared to 4.0.10, so I'd rather test 4.0.18 first and not stable 4.0.10. I'll also have a look at the 3.x patches, that sounds like a saner route.
I have now added a new revision with the backported fix from the redhat bug. Let's stable this revision and mark the 4.0.x series stable in its own time. =www-apache/passenger-3.0.21-r1
amd64 stable
x86 stable
CVE-2013-4136 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4136): ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
Thanks for your work GLSA vote: no
GLSA vote: no. closing noglsa.
