CVE-2012-0786

First published: Fri Jan 06 2012(Updated: )

Augeas is a configuration management API that represents the contents of config files as a tree in memory for editing, with the edits being written back to the actual file. By default it loads files it understands in a large number of standard system locations (/etc, /boot), but can also open files in a user specified location [1],[2]. It has two save modes of interest, "backup" that keeps the original in PATH.augorig and "newfile" that leaves the file alone, but writes the edited version to PATH.augnew. These can be set via the API [3] or --backup/--new with augtool (CLI tool around the API). A flaw was found in the current 0.10.0 version and most previous versions. It requires that the directory containing the file to be edited is writable by another user, so this needs the user to explicitly open a file in another location or for a file in a default location to be in a group/world writable directory. Augeas always opens PATH.augnew for writing, sets the file modes identically to PATH, writes the file contents and then renames PATH.augnew to PATH. Creation of a symlink at PATH.augnew will cause the new file contents to be written to the symlink target and then the symlink is moved to PATH. This enables an attacker to get to the file contents in the symlink target and also subvert PATH. The code's at src/transform.c in transform_save [4]. [1] <a href="http://augeas.net/page/Loading_specific_files">http://augeas.net/page/Loading_specific_files</a> [2] <a href="https://github.com/raphink/augeas-sandbox/blob/master/augload">https://github.com/raphink/augeas-sandbox/blob/master/augload</a> [3] <a href="http://augeas.net/docs/api.html#saving-the-tree">http://augeas.net/docs/api.html#saving-the-tree</a> [4] <a href="https://git.fedorahosted.org/cgit/augeas.git/tree/src/transform.c?id=547442f#n885">https://git.fedorahosted.org/cgit/augeas.git/tree/src/transform.c?id=547442f#n885</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/softwarecombine
• agent/first-publish-date
• agent/references
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/severity
• agent/author
• agent/weakness
• agent/description
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2012-0786
• agent/software-canonical-lookup
• agent/tags
• agent/event
• vendor/augeas
• canonical/augeas augeas
• version/augeas augeas/0.10.0
• version/augeas augeas/0.0.1
• version/augeas augeas/0.0.2
• version/augeas augeas/0.0.3
• version/augeas augeas/0.0.4
• version/augeas augeas/0.0.5
• version/augeas augeas/0.0.6
• version/augeas augeas/0.0.7
• version/augeas augeas/0.0.8
• version/augeas augeas/0.1.0
• version/augeas augeas/0.1.1
• version/augeas augeas/0.2.0
• version/augeas augeas/0.2.1
• version/augeas augeas/0.2.2
• version/augeas augeas/0.3.0
• version/augeas augeas/0.3.1
• version/augeas augeas/0.3.2
• version/augeas augeas/0.3.3
• version/augeas augeas/0.3.4
• version/augeas augeas/0.3.5
• version/augeas augeas/0.3.6
• version/augeas augeas/0.4.0
• version/augeas augeas/0.4.1
• version/augeas augeas/0.4.2
• version/augeas augeas/0.5.0
• version/augeas augeas/0.5.1
• version/augeas augeas/0.5.2
• version/augeas augeas/0.5.3
• version/augeas augeas/0.6.0
• version/augeas augeas/0.7.0
• version/augeas augeas/0.7.1
• version/augeas augeas/0.7.2
• version/augeas augeas/0.7.3
• version/augeas augeas/0.7.4
• version/augeas augeas/0.8.0
• version/augeas augeas/0.8.1
• version/augeas augeas/0.9.0
• package-manager/redhat