CVE-2010-2059: High severity RPM RPM vulnerability
Created attachment 418879 [details] SRPM for testing this bug
Description of problem: When RPM replaces an executable, it does not clear the setuid and setgid bits of the old file. Thus, if a user made a hard link to the old executable, he/she will still be able to run it with elevated privileges. This is bad if it was replaced because it had a vulnerability. The problem seems to occur only when executables are replaced, not when they are erased.
This is the same bug that was previously noted in dpkg: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=225692
Version-Release number of selected component (if applicable): rpm-4.8.0-14.fc13.x8664
How reproducible: Always
Steps to Reproduce: 1. Rebuild the attached SRPM twice, once with -D 'rel 1' and once with -D 'rel 2'. 2. mkdir /tmp/rpm-setuid-test 3. rpm -i rpm-setuid-test-0-1.fc13.$(rpm -E '%{buildarch}').rpm 4. ln /usr/bin/rpm-setuid-test /tmp/rpm-setuid-test/ 5. rpm -U rpm-setuid-test-0-2.fc13.$(rpm -E '%{buildarch}').rpm 6. ls -l /tmp/rpm-setuid-test/rpm-setuid-test
Actual results: The old executable is setuid.
Expected results: The old executable is not setuid.
Other sources
lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-2059?
CVE-2010-2059 is classified as a medium-severity vulnerability.
How do I fix CVE-2010-2059?
To remediate CVE-2010-2059, update the RPM package to a patched version, specifically 0:4.3.3-33_nonptl.el4_8.1 or 0:4.4.2.3-20.el5_5.1 depending on your system.
What systems are affected by CVE-2010-2059?
CVE-2010-2059 affects multiple versions of the RPM Package Manager including versions from 1.2 to 4.4.2.3.
What type of vulnerability is CVE-2010-2059?
CVE-2010-2059 is a security flaw related to potential privilege escalation.
Has CVE-2010-2059 been exploited in the wild?
There have been no widely reported exploits of CVE-2010-2059 in the wild.