Bug 78117 – app-i18n/zhcon: Unauthorized file access (CAN-2005-0072)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sune Kloppenborg Jeppesen (RETIRED) 2005-01-15 11:06:56 UTC]

Erik Sj

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-15 11:06:56 UTC]

Erik Sjölund discovered that zhcon, a fast console CJK system using
the Linux framebuffer, accesses a user-controlled configuration file
with elevated privileges.  Thus, it is possible to read arbitrary
files.

Please let me know if you need coordination for this bug.

This patch fixes the problem

--- zhcon-0.2.orig/src/configfile.cpp
+++ zhcon-0.2/src/configfile.cpp
@@ -19,13 +19,20 @@
 #include <stdexcept>
 #include <fstream>
 #include <cstdlib>
+#include <unistd.h>
+#include <sys/types.h>
 #include "configfile.h"
 
 ConfigFile::ConfigFile(const char *fn) {
+    uid_t euid;
+
+    euid = geteuid();
+    setuid(getuid());
     ifstream in(fn);
     if (!in)
         throw runtime_error("Could not open config file!");
     ParseFile(in);
+    setuid(euid);
 }
 
 ConfigFile::~ConfigFile() {}

[Comment 2 Thierry Carrez (RETIRED) 2005-01-18 08:44:53 UTC]

Maybe better wait for public disclosure on this one ?

[Comment 3 Thierry Carrez (RETIRED) 2005-01-20 01:46:11 UTC]

Created attachment 49025 [details, diff]
CAN-2005-0072.patch

Better patch, please ignore previous one.

[Comment 4 Luke Macken (RETIRED) 2005-01-24 17:28:09 UTC]

public @ http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:012

cjk, please apply patch.

[Comment 5 Jackey Yang ("timeout" in forum) 2005-01-25 08:21:12 UTC]

There is no one maintaining zhcon right now. The package is out of date, but just remove from portage.

[Comment 6 Mamoru KOMACHI (RETIRED) 2005-01-25 09:38:51 UTC]

I've just got this mail today (had mail problem for a week).
I'll apply the patch asap.

[Comment 7 Alastair Tse (RETIRED) 2005-01-25 10:00:32 UTC]

patch applied with zhcon-0.2.3-r1. in cvs.

[Comment 8 Thierry Carrez (RETIRED) 2005-01-26 00:37:49 UTC]

Ready for GLSA vote

[Comment 9 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-26 00:45:59 UTC]

I tend to vote for no GLSA on this one (few installs). 

[Comment 10 Alastair Tse (RETIRED) 2005-01-26 02:35:18 UTC]

not sure about the exact procedure, but both debian and mandrake posted one. 

[Comment 11 Thierry Carrez (RETIRED) 2005-01-26 04:13:15 UTC]

Alastair: we follow our own rules :) See vulnerability treatment policy at http://www.gentoo.org/security/en/vulnerability-policy.xml.

zhcon looks like a local tool which requires access to framebuffer console. If you have physical access to the machine, being able to read arbitrary files is probably the least you can do... so I tend to vote NO.

Third opinion ?

[Comment 12 Alastair Tse (RETIRED) 2005-01-26 06:01:44 UTC]

koon, valid point. i'll leave it up to you guys to decide the severity :)

[Comment 13 Stefan Cornelius (RETIRED) 2005-01-26 13:02:30 UTC]

I'd say GLSA is ok for this one.

[Comment 14 Luke Macken (RETIRED) 2005-01-27 04:15:46 UTC]

Eh, I would have to vote no.

[Comment 15 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-27 04:30:54 UTC]

Closing without GLSA. If anyone disagrees feel free to reopen.