Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 562898 - <app-admin/lsyncd-2.2.0: Direct mode allows injecting unauthorized filesystem operations
Summary: <app-admin/lsyncd-2.2.0: Direct mode allows injecting unauthorized filesystem...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks: CVE-2014-8990
  Show dependency tree
 
Reported: 2015-10-12 08:13 UTC by Agostino Sarubbo
Modified: 2017-02-01 09:22 UTC (History)
2 users (show)

See Also:
Package list:
=app-admin/lsyncd-2.2.0
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-10-12 08:13:45 UTC 
From ${URL} :

In the default-direct.lua file in the "event.etype == 'Move'" branch, instead of using a direct 
fork/exec, a shell is spawned. Its arguments aren't quoted so one can inject additional parameters 
using whitespace characters.

Original bug report containing reproducer and proposed patch:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801263


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Pacho Ramos gentoo-dev 2015-11-05 16:20:09 UTC 
2.1.6 version should solve this
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-07-19 10:22:50 UTC 
No rdeps... and maintainer-needed for quite some time.

@treecleaners, recommendation/thoughts?
Comment 3 devsk 2016-08-23 03:47:38 UTC 
So, just quoting of the arguments to 'mv' is needed. And we are ready to throw this package out of the tree?

Please, please leave it in there and add the patch attached to the debian.org link above to an -r1 release.
Comment 4 Patrick Lauer gentoo-dev 2016-08-26 05:39:42 UTC 
2.1.6 is in tree with maintainer.
Comment 5 Pacho Ramos gentoo-dev 2016-08-26 09:31:36 UTC 
CCing new maintainer
Comment 6 Dennis Schridde 2016-09-10 07:41:36 UTC 
Is stabilisation of 2.1.6 already in progress? With 2.1.5 gone, there is none left in stable.
Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-09 23:52:49 UTC 
(In reply to Pacho Ramos from comment #1)
> 2.1.6 version should solve this

No, it is not fixed in 2.1.6.

Upstream fixed via https://github.com/axkibe/lsyncd/commit/c4f4ac3e0155af93036414371ed74ed215889c91 and this only present in >=2.2.0 which is not in Gentoo repository.


@ Maintainer(s): Please bump to >=app-admin/lsyncd-2.2.0.
Comment 8 Patrick Lauer gentoo-dev 2017-01-28 20:12:20 UTC 
commit c4654db70af968a64534c61c868a761034e2c8cf
Author: Patrick Lauer <patrick@gentoo.org>
Date:   Sat Jan 28 21:11:08 2017 +0100

    app-admin/lsyncd: Bump
Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-30 00:12:35 UTC 
@ Arches,

please test and mark stable: =app-admin/lsyncd-2.2.0
Comment 10 Agostino Sarubbo gentoo-dev 2017-01-30 13:09:24 UTC 
amd64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2017-01-31 11:43:42 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.