CVE-2012-5635: Low severity centos glusterfs vulnerability
Following the fixing of several /tmp/ flaws in CVE-2012-4417 we have the remaining issues in Gluster reported by Kurt Seifried (kseifried):
============== This issue was previously not reported: This should probably use /var/run/gluster/glusterdump.%d.options
tests/volume.rc: rm -f /tmp/glusterdump.$mountpid.dump. 2>/dev/null tests/volume.rc: fname=$(ls /tmp | grep -E "glusterdump.$mountpid.dump.") tests/volume.rc: echo /tmp/$fname ============== ============== This issue was previously not reported: This should use mktemp Also this should use cp instead of mv so you don't lose SELinux context when copying the file back to /etc/samba/smb.conf which might break Samba
extras/hook-scripts/S30samba-stop.sh: cp /etc/samba/smb.conf /tmp/smb.conf extras/hook-scripts/S30samba-stop.sh: sed -i "/gluster-$volname/,/^$/d" /tmp/smb.conf &&\ extras/hook-scripts/S30samba-stop.sh: mv /tmp/smb.conf /etc/samba/smb.conf ==============
============== This issue was previously reported: This should use mkstemp()
libglusterfs/src/run.c: fd = open ("/tmp/foof", OWRONLY|OCREAT|OTRUNC, 0600); ==============
============== This issue was previously reported: This should probably use /var/run/gluster/glusterdump.%d.options
libglusterfs/src/statedump.c:/ These options are dumped by default if /tmp/glusterdump.options libglusterfs/src/statedump.c: / glusterd will create a file /tmp/glusterdump.<pid>.options and libglusterfs/src/statedump.c: both cli command and SIGUSR1, /tmp/glusterdump.options file libglusterfs/src/statedump.c: "/tmp/glusterdump.options"); libglusterfs/src/statedump.c: "/tmp/glusterdump.%d.options", getpid ()); libglusterfs/src/statedump.c: ((ctx->statedumppath != NULL)?ctx->statedumppath:"/tmp")), ==============
============== This issue was previously reported: This should probably use /var/run/gluster/glusterdump.%d.options
xlators/protocol/server/src/server.c: .defaultvalue = "/tmp", xlators/protocol/server/src/server.c: " statedumps. By default it is the /tmp directory" ============== ============== This issue was previously reported: This should probably use /var/run/gluster/%s-"RBCLIENTMOUNTPOINT
xlators/mgmt/glusterd/src/glusterd-replace-brick.c: snprintf (path, len, "/tmp/%s-"RBCLIENTMOUNTPOINT, volinfo->volname); ==============
============== This issue was previously reported: This should probably use /var/run/gluster/glusterdump.%d.options
xlators/mgmt/glusterd/src/glusterd-utils.c: snprintf (dumpoptionspath, sizeof (dumpoptionspath), "/tmp/glusterdump.%d.options", pid); xlators/mgmt/glusterd/src/glusterd-utils.c: snprintf (dumpoptionspath, sizeof (dumpoptionspath), "/tmp/glusterdump.%d.options", pid); ==============
Other sources
The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by (1) tests/volume.rc, (2) extras/hook-scripts/S30samba-stop.sh, and possibly other vectors, different vulnerabilities than CVE-2012-4417.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5635?
CVE-2012-5635 is classified as a low-severity vulnerability.
How do I fix CVE-2012-5635?
To mitigate CVE-2012-5635, update to the latest version of GlusterFS or Red Hat Storage products.
Which software is affected by CVE-2012-5635?
CVE-2012-5635 affects various versions of GlusterFS, Red Hat Storage Management Console, Red Hat Storage Native Client, and Red Hat Storage Server.
Is CVE-2012-5635 still a concern if previous CVEs were addressed?
Yes, CVE-2012-5635 remains a concern as it addresses separate issues that were not fixed in earlier updates.
What is the nature of CVE-2012-5635 vulnerability?
CVE-2012-5635 involves improper handling of temporary files in the indicated software.