CVE-2013-4159: High severity Ctdb Project Ctdb vulnerability

Kurt Seifried (kseifried) reports:

While looking at various components for Storage I ran across some tmp file issues in ctdb:

======================================== ./ctdb-1.0.114.5/tcp/tcpconnect.c: const char lockpath = "/tmp/.ctdbsocketlock"; const char lockpath = "/tmp/.ctdbsocketlock"; struct flock lock; int one = 1; int socksize;

/ in order to ensure that we don't get two nodes with the same adddress, we must make the bind() and listen() calls atomic. The SOREUSEADDR setsockopt only prevents double binds if the first socket is in LISTEN state / lockfd = open(lockpath, ORDWR|OCREAT, 0666); if (lockfd == -1) { DEBUG(DEBUGCRIT,("Unable to open %s\n", lockpath)); return -1; } ======================================== ./ctdb-1.0.114.5/server/eventscript.c: " >/tmp/ctdb.event.%s.%d", tbuf, getpid()); sprintf(buf, "{ pstree -p; cat /proc/locks; ls -li /var/ctdb/ /var/ctdb/persistent; }" " >/tmp/ctdb.event.%s.%d", tbuf, getpid()); system(buf); ======================================== ./ctdb-1.0.114.5/tools/ctdbdiagnostics:ERRORS="/tmp/diagerr.$$" ./ctdb-1.0.114.5/tools/ctdbdiagnostics: tmpf=/tmp/basename $f.node$i ./ctdb-1.0.114.5/tools/ctdbdiagnostics: tmpf=/tmp/basename $f.node$i shell script, easy to exploit. ======================================== ./ctdb-1.0.114.5/config/gdbbacktrace:BATCHFILEPRE=/tmp/gdbbacktracepre.$$ ./ctdb-1.0.114.5/config/gdbbacktrace:BATCHFILEMAIN=/tmp/gdbbacktracemain.$$ shell script, easy to exploit. ======================================== ./ctdb-1.0.114.5/config/ctdb.sysconfig:# defaults to /tmp/ctdb.socket ./ctdb-1.0.114.5/config/ctdb.sysconfig:# CTDBSOCKET=/tmp/ctdb.socket This appears to be used unsafely later on ======================================== ./ctdb-1.0.114.5/include/ctdbprivate.h:#define CTDBPATH "/tmp/ctdb.socket" This appears to be used unsafely later on ========================================

It varies a bit in newer versions but the core problems are present.