Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.

Created attachment 525110 [details] testcase

Description of problem:

int off = ntohl(pe->offset);

if (hdrchkData(off)) goto errxit; if (off) { sizet nb = REGIONTAGCOUNT; int32t stei[nb]; / XXX Hmm, why the copy? / memcpy(&stei, dataStart + off, nb);

No check for dataStart + off > dataEnd.

(gdb) r --checksig rpminput.rpm [Thread debugging using libthreaddb enabled] Using host libthreaddb library "/lib/libthreaddb.so.1". error: no dbpath has been set error: cannot open Packages database in /%{dbpath}

Program received signal SIGSEGV, Segmentation fault. memcpy () at ../sysdeps/x8664/memcpy.S:117 117 ../sysdeps/x8664/memcpy.S: No such file or directory. in ../sysdeps/x8664/memcpy.S (gdb) bt #0 memcpy () at ../sysdeps/x8664/memcpy.S:117 #1 0x00007ffff7946493 in headerLoad (uh=0x623e00) at header.c:831 #2 0x00007ffff7946af9 in headerRead (fd=0x622180, magicp=HEADERMAGICYES) at header.c:994 #3 0x00007ffff79731d1 in readFile (fd=0x622180, fn=0x60a080 "rpminput.rpm", dig=0x622ab0, plbundle=0x6223b0, hdrbundle=0x622420) at rpmchecksig.c:462 #4 0x00007ffff7973c29 in rpmpkgVerifySigs (keyring=0x620ef0, flags=1572865, fd=0x622180, fn=0x60a080 "rpminput.rpm") at rpmchecksig.c:689 #5 0x00007ffff797429e in rpmcliSign (ts=0x621630, qva=0x7ffff7bab180, argv=0x609ed8) at rpmchecksig.c:824 #6 0x00000000004036e0 in main (argc=3, argv=0x7fffffffe458) at rpmqv.c:787

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

IssueDescription:

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation.

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

A flaw was found in rpm. Given an RPM package signed by a trusted key, it is possible to modify it such that it still passes signature checks, but installing it corrupts the rpmdb.

The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.

A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.