CVE-2016-9595: High severity katello vulnerability
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
Other sources
Evgeni Golov of Red Hat reports:
It was found that katello-debug.sh uses static, perfectly guessable paths in /tmp for its temporary files, which can lead to symlink attacks on /tmp/tasksexport.log and /tmp/pulprunningtasks.js leading to overwritten files anywhere on the system (as katello-debug is run via sos as root), or code execution inside of mongo via /tmp/pulprunningtasks.js if $user pre-creates that file and overwrites the file after command is echoed there, modifying it at his own will before calling mongo on it.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1405387
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9595?
CVE-2016-9595 has a moderate severity rating due to the potential for local users to exploit the vulnerability.
How do I fix CVE-2016-9595?
To fix CVE-2016-9595, upgrade katello to version 3.4.0 or later.
What type of attack is associated with CVE-2016-9595?
CVE-2016-9595 is associated with a symbolic-link attack that allows local users to overwrite arbitrary files.
Which software versions are affected by CVE-2016-9595?
CVE-2016-9595 affects katello versions prior to 3.4.0 and Red Hat Satellite and Capsule versions 6.3.
Who reported CVE-2016-9595?
CVE-2016-9595 was reported by Evgeni Golov of Red Hat.