Bug 194550 – app-admin/rmake <1.0.12 local priv escalation issue (CVE-2007-5194)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jonathan Smith (RETIRED) 2007-10-02 20:31:30 UTC]

In an internal review, rPath has discovered a security issue
affecting the rMake build tool.  In its build change-root
environments, it creates a devince file called "/dev/zero" with
the device numbers belonging to /dev/port, with read and write
permissions available to any user able to use rMake.  This is a
potential local user superuser arbitrary code execution issue.

Reproducible: Always

[Comment 1 Jonathan Smith (RETIRED) 2007-10-02 20:32:55 UTC]

rMake has never had a stable version in the portage tree, so no advisory is required. CCing security@ in case they have other input.

[Comment 2 Jonathan Smith (RETIRED) 2007-10-02 20:36:16 UTC]

Created attachment 132421 [details, diff]
patch from rpath to fix this issue

[Comment 3 Pierre-Yves Rofes (RETIRED) 2007-10-02 20:40:29 UTC]

(In reply to comment #1)
> rMake has never had a stable version in the portage tree, so no advisory is
> required. CCing security@ in case they have other input.
> 

Yeah well since it's a security issue, please assign it directly to security :)
Would it be possible to have a fixed version in the tree? thanks.

[Comment 4 Jonathan Smith (RETIRED) 2007-10-02 20:43:39 UTC]

(In reply to comment #3)
> Yeah well since it's a security issue, please assign it directly to security :)
> Would it be possible to have a fixed version in the tree? thanks.

OK, my bad about the assignee.

I'll update the ebuild as soon as my gentoo box is re-delivered from Fedex (long story. *should* be <24 hrs).

[Comment 5 Tobias Heinlein (RETIRED) 2007-10-05 13:20:20 UTC]

*** Bug 194800 has been marked as a duplicate of this bug. ***

[Comment 6 Sune Kloppenborg Jeppesen (RETIRED) 2007-10-17 18:53:24 UTC]

Any news on this one?

[Comment 7 Pierre-Yves Rofes (RETIRED) 2007-11-01 19:20:05 UTC]

any news here?

[Comment 8 Jonathan Smith (RETIRED) 2007-11-20 04:12:27 UTC]

yeah, sorry. the box arrived damaged and I haven't had time to repair it. if someone else wants to, an update to .12 should cause no issues. tarball is here: ftp://download.rpath.com/rmake/rmake-1.0.12.tar.bz2

[Comment 9 Robert Buchholz (RETIRED) 2008-01-08 01:15:58 UTC]

*rmake-1.0.13 (08 Jan 2008)

  08 Jan 2008; Robert Buchholz <[e-mail]> +rmake-1.0.13.ebuild:
  Version bump to fix privilege escalation vulnerability (bug #194550).
  For more changes, see NEWS file.