It was discovered that RPM did not properly validate region size in headerLoad() when loading header from an RPM file, allowing region size to exceed containing header size. A malformed or malicious RPM file could cause RPM to crash and possibly execute arbitrary code before file signature was properly verified.

Upstream commits: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=472e569562d4c90d7a298080e0052856aa7fa86b http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=858a328cd0f7d4bcd8500c78faaf00e4f8033df6

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

rpmbuild in RPM 4.8.0 and earlier does not properly parse the syntax of spec files, which allows user-assisted remote attackers to remove home directories via vectors involving a ;~ (semicolon tilde) sequence in a Name tag.

Common Vulnerabilities and Exposures assigned an identifier CVE-2005-4889 to the following vulnerability:

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

References: https://bugzilla.redhat.com/showbug.cgi?id=125517 https://bugzilla.redhat.com/showbug.cgi?id=598775 http://xforce.iss.net/xforce/xfdb/59426

This issue was fixed in Fedora rpm some time ago via bug #125517. RPM versions in Red Hat Enterprise Linux 3 and 4 do not contain the fix and are affected.

Created attachment 418879 [details] SRPM for testing this bug

Description of problem: When RPM replaces an executable, it does not clear the setuid and setgid bits of the old file. Thus, if a user made a hard link to the old executable, he/she will still be able to run it with elevated privileges. This is bad if it was replaced because it had a vulnerability. The problem seems to occur only when executables are replaced, not when they are erased.

This is the same bug that was previously noted in dpkg: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=225692

Version-Release number of selected component (if applicable): rpm-4.8.0-14.fc13.x8664

How reproducible: Always

Steps to Reproduce: 1. Rebuild the attached SRPM twice, once with -D 'rel 1' and once with -D 'rel 2'. 2. mkdir /tmp/rpm-setuid-test 3. rpm -i rpm-setuid-test-0-1.fc13.$(rpm -E '%{buildarch}').rpm 4. ln /usr/bin/rpm-setuid-test /tmp/rpm-setuid-test/ 5. rpm -U rpm-setuid-test-0-2.fc13.$(rpm -E '%{buildarch}').rpm 6. ls -l /tmp/rpm-setuid-test/rpm-setuid-test

Actual results: The old executable is setuid.

Expected results: The old executable is not setuid.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2198 to the following vulnerability:

Name: CVE-2010-2198 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2198 Assigned: 20100608 Reference: MLIST:[oss-security] 20100602 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) Reference: URL: http://www.openwall.com/lists/oss-security/2010/06/02/3 Reference: MLIST:[oss-security] 20100603 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) Reference: URL: http://marc.info/?l=oss-security&m=127559059928131&w=2 Reference: MLIST:[oss-security] 20100603 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) Reference: URL: http://www.openwall.com/lists/oss-security/2010/06/03/5 Reference: MLIST:[oss-security] 20100604 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) Reference: URL: http://www.openwall.com/lists/oss-security/2010/06/04/1 Reference: CONFIRM: http://rpm.org/gitweb?p=rpm.git;a=commit;h=4d172a194addc49851e558ea390d3045894e3230 Reference: CONFIRM: https://bugzilla.redhat.com/showbug.cgi?id=598775 Reference: OSVDB:65144 Reference: URL: http://www.osvdb.org/65144 Reference: SECUNIA:40028 Reference: URL: http://secunia.com/advisories/40028

lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to gain privileges or bypass intended access restrictions by creating a hard link to a vulnerable file that has (1) POSIX file capabilities or (2) SELinux context information, a related issue to CVE-2010-2059.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2199 to the following vulnerability:

Name: CVE-2010-2199 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199 Assigned: 20100608 Reference: CONFIRM: https://bugzilla.redhat.com/showbug.cgi?id=125517

lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to bypass intended access restrictions by creating a hard link to a vulnerable file that has a POSIX ACL, a related issue to CVE-2010-2059.

See bug #598775 for an initial description and comments of this issue. Because different CVE names were assigned for different, yet related, issues, a separate bug has been filed for this particular issue.