|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: Users in group "games" can become root | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Stefan Nordhausen <nordhaus> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | aj, meissner, mls, ro |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | CVE-2005-3321: CVSS v2 Base Score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P) | ||
| Found By: | Other | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Stefan Nordhausen
2005-08-09 21:09:44 UTC
Well spotted! It proves once again that there is no such thing as an innocent s bit. We'll have to update the permissions and filesystem packages to change /var/games to root:root 755 as well as any other package that has a group games writeable directory. xsok contains /var/games/xsok which is group writeable as well and contains files that are changed by the permissions package. That one has to be root:root as well. After talking with mls we came to the conclusion to fix it the following way:
- /var/games will be root:root 755
- games should not use world or group writeable directories
- rpms need to have highscore files as %ghost and create them with
test -e /var/games/foo || \
install -m 664 -o root -g games /dev/null /var/games/foo
- install will be patched to be less racy (ie use fchown).
for released distro we need to update permissions and filesystem to
change /var/games to root:root 755. Since that may break stuff we will first
test the change with 10.0.
Ok, discussed again. If the highscore file doesn't change it's md5sum in the rpm (e.g. because its initially always zero) the preferred way to package it is %verify(not md5 size mtime) %config(noreplace) %attr(664,root,games) /var/games/foo Maintenance-Tracker-2408 Will update permissions in sles8, permissions and xmcd in 9.0, permissions and filessytem in 9.1-9.3. SUSE QA: After installing the maintenance update on sles8 (edeece9a87d211ef0c08ea0e95918b32, patch-10516) I have puppis:~ # grep -Er ".games.*(66|77)" /etc/permissions* /etc/permissions:/var/games/ games:games 0775 This conflicts with Comment #3! SUSE QA: Comment #6 applies to the maintenance update for sles9 (cd99cc1034cc89ae4051288a7e0a8b21, patch-10514), too. I think some internal discussions were not fully tracked in here. at least the STABLE permissions has this entry: ------------------------------------------------------------------- Fri Sep 30 13:28:00 CEST 2005 - lnussel@suse.de - add slashes to several directories (#103186) - change /var/games to games:games 775 again (#103186) So that it is /var/games games:games 775 appears intentional by Ludwig. Ludwig will be back on 18.10.2005 and we will wait until he is back for further discussion. Yes, there is off-line discussion with mls missing, sorry. We determined that the previous suggestion does not fix the problem completely. We now just don't change permissions of any files below /var/games anymore. Therefore it's safe to set it back to 775. For cases where it can't be avoided to change permissions of sub*directories* of world writable directories (/usr/src/packages/*) slashes have been appended to the filenames so chkstat will fail if it finds a file instead. packages approved it gets worse with every try to fix it *grmpf* new packages and patchinfos submitted updates and advisory released CVE-2005-3321 CVE-2005-3321: CVSS v2 Base Score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P) making a public bug |