Bugzilla Bug 97175

Hello,

Look at :

cts/CTStests.py.in

873         fstmpfile = "/tmp/band_estimate"
874         dumpcmd = "tcpdump -p -n -c 102 -i any udp port %d > %s 2>&1" \
875         %               (port, fstmpfile);

1076             self.CM.rsh(node,"cp /proc/drbd /tmp >/dev/null 2>&1")
1077             if self.CM.rsh.cp("%s:/tmp/drbd" % node,"/tmp"):
1078                 line = open("/tmp/drbd").readlines()[2]

1113         if self.CM.rsh(node,self.CM["DRBDCheckconf"])==0:
1114             self.CM.rsh.cp("%s:/tmp/drbdconf" % node, "/tmp")
1115             lines=open("/tmp/drbdconf","r")

Also in :

heartbeat/lib/BasicSanityCheck.in

46 LOGFILE=/tmp/linux-ha.testlog

This file contain a lot off actions on the insecure tmp file.

Also in :

lib/stonith/meatclient.c

58         const char *    meatpipe_pr = "/tmp/.meatware";
101                 snprintf(meatpipe, 256, "%s.%s", meatpipe_pr, opthost);

Regards.

(In reply to comment #0)
> cts/CTStests.py.in
> 
> 873         fstmpfile = "/tmp/band_estimate"
> 874         dumpcmd = "tcpdump -p -n -c 102 -i any udp port %d > %s 2>&1" \
> 875         %               (port, fstmpfile);

confirmed, insecure temp file handling.

> 1076             self.CM.rsh(node,"cp /proc/drbd /tmp >/dev/null 2>&1")
> 1077             if self.CM.rsh.cp("%s:/tmp/drbd" % node,"/tmp"):
> 1078                 line = open("/tmp/drbd").readlines()[2]

confirmed, second order symlink attack.

> 1113         if self.CM.rsh(node,self.CM["DRBDCheckconf"])==0:
> 1114             self.CM.rsh.cp("%s:/tmp/drbdconf" % node, "/tmp")
> 1115             lines=open("/tmp/drbdconf","r")

confirmed, second order symlink attack via scp.

> heartbeat/lib/BasicSanityCheck.in
> 
> 46 LOGFILE=/tmp/linux-ha.testlog

confirmed, second order again.

> lib/stonith/meatclient.c
> 
> 58         const char *    meatpipe_pr = "/tmp/.meatware";
> 101                 snprintf(meatpipe, 256, "%s.%s", meatpipe_pr, opthost);
> 
> Regards.

confirmed, looks like it needs some O_EXCL goodness line ~103.

Eric, please tell us when upstream is advised...

Hello,

Vendor informed.

Regards.

Leaked by Secunia, SA16039

Pulling in maintainer

Cluster, please provide an updated ebuild. 

can someone please test and commit this pack-of-debian-security-patches [1] to 
1.2.3?

i have no heartbeat installations currently.

[1] http://dev.gentoo.org/~voxus/stuff/heartbeat-1.2.3-debian_security_fixes.
patch

reply to #7: 

sure, I'll test it.

reply to #8:

do they work and if yes, do you want to commit them?

heartbeat-1.2.3-r1 is on cvs (with the suggested fix), but it's not marked
stable.

Security Team please review it and mark it stable (almost on x86 as the
previous
one).

x86 please test and mark stable. 

x86 testers, or cluster herd: could you test and mark stable on x86 ?

The patch works fine but I've found another problem.

LVM scripts in heartbeat doesn't works fine with LVM2, the patch fixes also this
behaviour but we haven't /sbin/lvmiopversion util (from lvm-common) in the portage.

So, I've splitted the patch and marked stable the -r1 ebuild with the security
fix and I've added another ebuild (-r2) with an experimental LVM2 fix.

Please don't close security bugs, we'll do it when we are finished with them.
Security: please vote on GLSA need.

I don't know what to vote, on one hand, those are probably root-executed
scripts, on the other, heartbeat is not something you often find on multiuser
setups... I guess I vote half-yes...

Half YES from me as well. 

weak YES also

OK, let's make that a full yes.

GLSA 200508-05