IssueDescription:
In a Kerberos environment, OpenSSH allows remote, authenticated users to log in as another user if they are listed in a ~/.k5users file of that other user. This unexpectedly alters the system security policy, as expressed through the ~/.k5users file, because previously, users would have to log in locally, potentially requiring different forms of authentication, before they could use the ksu command to switch users.
Tavis Ormandy reported that seunshare, part of policycoreutils, was shipped setuid root and failed to enforce proper permissions on an alternate temporary directory mounted as /tmp. This could potentially lead to privilege escalation in certain privileged applications that assume /tmp to be sticky and root-owned.
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
Comix 3.6.4 creates temporary directories with predictable names, which allows local users to cause an unspecified denial of service.
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
The silcpkcs1decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow. NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.
The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."
KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes sendinterface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Description of problem:
The Diatheke CGI allows arbitrary command execution in the context of the webserver, e.g. www-data by simply abusing the range parameter.
For example, &range=yes will consume tons of resources on the affected webserver. Escalation of privleges and command shells are left as an exercise to the reader.
From Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449
The excelreadHLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow. NOTE: some of these details are obtained from third party information.
modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
Description of problem: Fuse in general and Fedora's way to let only members of the group fuse access and use fuse was discussed in https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html and mails below in that thread.
There we noticed that members of the group fuse can get access to devices which they normally should not have access to. See https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00163.html ; the relevant parts of it:
$ ls -l /dev/sda3 brw-r----- 1 root disk 8, 3 14. Sep 16:10 /dev/sda3 $ groups thl fuse $ dd if=/dev/sda3 bs=512K count=1 | strings dd: opening /dev/sda3': Permission denied $ mkdir ntfs $ /sbin/mount.ntfs-3g /dev/sda3 ntfs/ $ touch ntfs/foo $ ls -l ntfs/foo -rwxrwxrwx 1 thl thl 0 18. Sep 19:27 ntfs/foo
ntfs-3g IMHO should fail, as the users should not get access to random devices he has no access to. Quoting Alexander Larsson from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00171.html
Thats quite weird. The way I undestand fuse is that you run the filesystem as your user, and then that filesystem (via libfuse) spawns fusermount to open the fuse device and attach to the mountpoint. fusermount then passes the fd to the fuse device back the the filesystem process (via a socket) which then handles all the requests. Reading the data source for the filesystem (if there is any) is only done by the filesystem process, not by the setuid fusermount helper, so it should not be able to read /dev/sda3.
Further investigation showed that ntfs-3g gets installed SUID root:
$ ls -l /sbin/mount.ntfs-3g -rwsr-xr-- 1 root fuse 40528 17. Sep 23:14 /sbin/mount.ntfs-3g
That might be wrong as that afaics makes it possible for ntfs-3g to access devices which the user normally would not have access to. Quoting Alexander again, this time from https://www.redhat.com/archives/fedora-desktop-list/2007-September/msg00174.html
Oh. That seems like a bad idea to me. If this drops privs after opening the device I think you can attach to the process using e.g. gdb and call any read() operation on the device. If might even mean (with some creative exploits) that any fuse group user can read any block on any disk.
Version-Release number of selected component (if applicable): ntfs-3g-1.913-1.fc8
Please note that I as ex-maintainer of fuse stumbled into this by accident -- I don't care much about fuse and ntfs-3g these days, but I think the behavior of ntfs-3g is a security bug.
End of life: 6/13/2008, Latest version: 7