CVE-2015-1815: Command Injection
First published: Wed Mar 18 2015(Updated: )
It was found that setroubleshoot did not sanitize file names supplied in a shell command look-up for RPMs associated with access violation reports. An attacker could use this flaw to escalate their privileges on the system by supplying a specially crafted file to the underlying shell command. The vulnerable code in util.py: 266 def get_rpm_nvr_by_file_path_temporary(name): 267 if name is None or not os.path.exists(name): 268 return None 269 270 nvr = None 271 try: 272 import commands 273 rc, output = commands.getstatusoutput("rpm -qf '%s'" % name) 274 if rc == 0: 275 nvr = output 276 except: 277 syslog.syslog(syslog.LOG_ERR, "failed to retrieve rpm info for %s" % name) 278 return nvr Acknowledgements: Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Selinux Setroubleshoot | <=3.2.21 | |
| Fedoraproject Fedora | =22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1003803&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1003803&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1203352#c10
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1004551&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1004551&action=edit
- http://www.openwall.com/lists/oss-security/2015/03/26/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1206050
- https://github.com/stealth/troubleshooter
- https://rhn.redhat.com/errata/RHSA-2015-0729.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1203352
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154427.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154444.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154147.html
- http://rhn.redhat.com/errata/RHSA-2015-0729.html
- http://www.osvdb.org/119966
- http://www.securityfocus.com/bid/73374
- https://bugzilla.redhat.com/show_bug.cgi?id=1206050
- https://www.exploit-db.com/exploits/36564/
- collector/redhat-bugzilla
- alias/CVE-2015-1815
- collector/nvd-index
- vendor/selinux
- canonical/selinux setroubleshoot
- version/selinux setroubleshoot/3.2.21
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/22