CVE-2013-0261: Packstack: packstack: arbitrary file overwrite via symlink attack
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Other sources
A flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the /tmp directory. This vulnerability allows the local user to overwrite arbitrary files on the system, potentially leading to system compromise or data corruption.
— MITRE
Kurt Seifried of Red Hat reports:
./packstack/installer/basedefs.py ============ VARDIR = os.path.join("/var/tmp/packstack", datetime.datetime.now().strftime('%Y%m%d-%H%M')) DIRLOG = VARDIR PUPPETMANIFESTDIR = os.path.join(VARDIR, "manifests") ============
./packstack/modules/ospluginutils.py ============ def appendManifestFile(manifestname, data, marker=''): if not os.path.exists(basedefs.PUPPETMANIFESTDIR): os.mkdir(basedefs.PUPPETMANIFESTDIR) manifestfile = os.path.join(basedefs.PUPPETMANIFESTDIR, manifestname) manifestfiles.addFile(manifestfile, marker) with open(manifestfile, 'a') as fp: fp.write("\n") fp.write(data) ============
So we have several failures here:
1) not setting safe permissions (we don't set permissions/use os.umask/etc.) which means attackers can read the data, possibly modify it/etc.
2) not creating directories safely, there is a potential gap between "if not os.path.exists" and the "os.mkdir" amongst other problems
This can be used to modify manifest files at creation time for example.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0261?
CVE-2013-0261 is classified as a moderate severity vulnerability due to its potential impact on file overwriting via symlink attacks.
How do I fix CVE-2013-0261?
To remediate CVE-2013-0261, ensure that the affected software versions are upgraded to non-vulnerable releases or apply the relevant patches provided by the maintainers.
What software versions are affected by CVE-2013-0261?
CVE-2013-0261 affects OpenStack Essex and OpenStack Folsom versions.
Can CVE-2013-0261 be exploited remotely?
CVE-2013-0261 requires local access to the system for exploitation, making it less of a threat for remote attackers.
What types of attacks does CVE-2013-0261 facilitate?
CVE-2013-0261 facilitates symlink attacks allowing local users to overwrite arbitrary files.