Bug 105000 - app-backup/flexbackup <= 1.2.1 multiples vulnerabilities
|
Bug#:
105000
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: normal
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: zataz@zataz.net
|
|
Component: Default Configs
|
|
|
URL:
|
|
Summary: app-backup/flexbackup <= 1.2.1 multiples vulnerabilities
|
|
Keywords:
|
|
Status Whiteboard: [noglsa] jaervosz
|
|
Opened: 2005-09-06 04:05 0000
|
Hello,
* In /etc/flexbackup.conf :
$tmpdir = '/tmp';
* Into flexbackup :
&checkvar(\$cfg::tmpdir,'tmpdir','exist','/tmp');
If tmpdir is not defined /tmp is used by default, but here into conf file tmpdir
is by default set to /tmp
5229 my $tmp_script = "$cfg::tmpdir/buftest.$host.$PROCESS_ID.sh";
5236 # Create a script which tests the buffer program
5237 open(SCR,"> $tmp_script") || die;
5238 print SCR "#!/bin/sh\n";
5239 print SCR "tmp_data=/tmp/bufftest\$\$.txt\n";
5240 print SCR "tmp_err=/tmp/bufftest\$\$.err\n";
5241 print SCR "echo testme > \$tmp_data\n";
5242 print SCR "$buffer_cmd > /dev/null 2> \$tmp_err < \$tmp_data\n";
5243 print SCR "res=\$?\n";
5244 print SCR "out=\`cat \$tmp_err\`\n";
5245 print SCR "if [ \$res -eq 0 ]; then\n";
5246 print SCR " echo successful\n";
5247 print SCR "else\n";
5248 print SCR " echo \"unsuccessful: exit code \$res: \$out\" \n";
5249 print SCR "fi\n";
5250 print SCR "rm -f \$tmp_data \$tmp_err\n";
5251 close(SCR);
Here we have possible symlink attack (race condition), and also possibility to
create a untrusted script into the tmp_script (race condition).
The script how is created is also vulnerable to possible symlink attack (race
condition).
5253 if ($host eq 'localhost') {
5254 print $::msg "| Checking '$cfg::buffer' on this machine... ";
5255 $pipecmd = "sh $tmp_script ";
5256 } else {
5257 print $::msg "| Checking '$cfg::buffer' on host $host... ";
5258 $pipecmd = "cat $tmp_script | ($::remoteshell $host 'cat >
$tmp_script; sh $tmp_script; rm -f $tmp_script' )";
We see here that the untrusted script could be executed on localhost or remote host.
5446 my $tmp1 = "$cfg::tmpdir/test1.$PROCESS_ID";
5447 my $tmp2 = "$cfg::tmpdir/test2.$PROCESS_ID";
5448 my $tmp3 = "$cfg::tmpdir/test3.$PROCESS_ID";
Here the $cfg::pad_blocks should be false to exploit the possible symlink attack
(race condition). By default in the conf file pad_blocks is true. No risk if no
configuration modification.
359 if (defined($::pkgdelta)) {
360 if (defined($::local)) {
361 &list_packages('localhost');
362 &find_packaged_files('localhost');
363 &find_changed_files('localhost');
364 }
365 foreach my $host (keys %::remotehosts) {
366 &list_packages($host);
367 &find_packaged_files($host);
368 &find_changed_files($host);
369 }
370 $::pkgdelta_filelist = "$cfg::tmpdir/pkgdelta.$PROCESS_ID";
371 &line();
372 }
Here we have possible symlink attack (race condition)
619 my $exitscript = "$cfg::tmpdir/collectexit.$PROCESS_ID.sh";
620 my $result = "$cfg::tmpdir/exitstatus.$PROCESS_ID";
841 unlink($result);
842 open(SCR, "> $exitscript") || die;
843 print SCR '#!/bin/sh' . "\n";
844 print SCR '"$@"' . "\n";;
845 print SCR '[ $? = 0 ] || echo $@ >> ' . $result . "\n";
846 close(SCR);
847 chmod(0755, $exitscript);
848
849 push(@cmds, "[ ! -e $result ]");
850 }
This one is more difficult to race.
Regards.
yes, looks like a Default Config issue, changing component..
Hello,
Upsteam provide the config file with $tmpdir = '/tmp';
Should I contact upstream ?
Regards.
Hello,
No response from upstream.
Release date : 2005-10-15
Send to vendor-sec@lst.de
Regards.
max/mholzer please attach an updated ebuild.
Do NOT commit anything to Portage.
Thx Mike.
Calling arch security liaisons to test and report back on this bug:
hppa hansmi
ppc hansmi
x86 tester
you have my ok to commit straight to stable on x86
SpanKY feel free to commit the ebuild
Default config -> closing without GLSA.
(In reply to comment #14)
> Default config -> closing without GLSA.
>
The patch breaks the ability to backup remote machines.
The additional directory is created only locally, but not promoted to the
remote machine.
The errors look like this:
|------------------------------------------------------------
| File number 12, tape index 200512202202
| Backup of: border:/etc
| Date of this level 2 backup: Thu Dec 22 05:31:07 2005
| Date of last level 1 backup: Wed Dec 21 05:21:00 2005
|------------------------------------------------------------
| ssh border 'touch -t "200512210521.00" /tmp/6136/refdate.6136'
| ssh border 'printf "mp3 MP3 Z z gz gif zip ZIP lha jpeg jpg JPG taz tgz \
| deb rpm bz2 lzo" > /tmp/6136/nocompress.6136'
| ssh border 'printf "Volume Label:\nlevel 2 border:/etc Thu Dec 22 \
| 05:31:07 2005 afio+gzip from joker\n\n" > /tmp/6136/label.6136'
| /tmp/6136/collectexit.6136.sh ssh border 'cd "/etc" && (printf \
| "//--/tmp/6136/label.6136 flexbackup.volume_header_info\n" && find . \
| -depth -xdev ! -type s -newer "/tmp/6136/refdate.6136" ! -regex \
| ".*/[Cc]ache/.*" ! -regex ".*~"$ -print ) | afio -o -E \
| /tmp/6136/nocompress.6136 -z -1 m -P gzip -Q -4 -Z -M 2m -T 3k -v -' | \
| /tmp/6136/collectexit.6136.sh cat > "/dev/nst0"
| ssh border 'rm -f /tmp/6136/refdate.6136 /tmp/6136/nocompress.6136 \
| /tmp/6136/label.6136'
| [ ! -e /tmp/6136/exitstatus.6136 ]
|------------------------------------------------------------
touch: cannot touch `/tmp/6136/refdate.6136': No such file or directory
ERROR: non-zero exit from:
You should open a new bug, this is no longer a security issue, it's just a
patch that broke functionality... and needs to be fixed.
> You should open a new bug, this is no longer a security issue, it's just a
> patch that broke functionality... and needs to be fixed.
You're correct. Filed as bug #116510
