CVE-2012-0786: Low severity augeas lenses vulnerability
Augeas is a configuration management API that represents the contents of config files as a tree in memory for editing, with the edits being written back to the actual file. By default it loads files it understands in a large number of standard system locations (/etc, /boot), but can also open files in a user specified location [1],[2].
It has two save modes of interest, "backup" that keeps the original in PATH.augorig and "newfile" that leaves the file alone, but writes the edited version to PATH.augnew. These can be set via the API [3] or --backup/--new with augtool (CLI tool around the API).
A flaw was found in the current 0.10.0 version and most previous versions. It requires that the directory containing the file to be edited is writable by another user, so this needs the user to explicitly open a file in another location or for a file in a default location to be in a group/world writable directory.
Augeas always opens PATH.augnew for writing, sets the file modes identically to PATH, writes the file contents and then renames PATH.augnew to PATH.
Creation of a symlink at PATH.augnew will cause the new file contents to be written to the symlink target and then the symlink is moved to PATH. This enables an attacker to get to the file contents in the symlink target and also subvert PATH.
The code's at src/transform.c in transformsave [4].
[1] http://augeas.net/page/Loadingspecificfiles [2] https://github.com/raphink/augeas-sandbox/blob/master/augload [3] http://augeas.net/docs/api.html#saving-the-tree [4] https://git.fedorahosted.org/cgit/augeas.git/tree/src/transform.c?id=547442f#n885
Other sources
The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0786?
CVE-2012-0786 is classified as a moderate severity vulnerability.
How do I fix CVE-2012-0786?
To mitigate CVE-2012-0786, upgrade Augeas to the latest version available or apply the necessary patches provided by your distribution.
What versions of Augeas are affected by CVE-2012-0786?
Augeas versions up to and including 1.0.0 are affected by CVE-2012-0786.
What type of vulnerability is described in CVE-2012-0786?
CVE-2012-0786 describes a configuration management vulnerability that could allow unauthorized access to sensitive configuration data.
Is there a workaround for CVE-2012-0786?
The recommended workaround for CVE-2012-0786 is to restrict access to the affected files and directories until an update can be applied.