Bug 1036756 (CVE-2017-9286) - VUL-1: CVE-2017-9286: nextcloud package security issues
Summary: VUL-1: CVE-2017-9286: nextcloud package security issues
Status: RESOLVED FIXED
Alias: CVE-2017-9286
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P4 - Low : Normal (vote)
Target Milestone: ---
Assignee: Security Team bot
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-04-28 09:36 UTC by Ludwig Nussel
Modified: 2019-02-12 13:40 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2017-04-28 09:36:30 UTC
https://build.opensuse.org/package/view_file/openSUSE:Factory/nextcloud/nextcloud.spec?expand=1

Ignoring that /srv/www/htdocs violates current packaging guidelines for a moment I'm sure the package puts user owned directories in user owned directories in there. Such a setup is not safe for rpm. Worst case privilege escalation.

Commands like
  service apache2 status | grep running > /tmp/apache_stopped_during_nextcloud_install

Allow symlink attacks

using su in scriptlets may not be safe either.
Comment 1 Eric Schirra 2017-04-28 10:58:43 UTC
I don't understand the problem.
This only runs on update or install.
Install or update packages runs every time under root.

For update nextcloud must be set in maintenance mode ON.
And after update in maintenance mode OFF.

The grep only writes something like:
 Active: active (running) since Mon 2017-04-24 13:06:23 CEST; 3 days ago

Where is now the problem?
Comment 2 Ludwig Nussel 2017-04-28 11:15:59 UTC
(In reply to Eric Schirra from comment #1)
> Install or update packages runs every time under root.

Exactly. When you write to locations where unprivileged can write
too, anyone can create symlinks where the root process then writes
into.

So use /run instead of /tmp and only package subdirectories of root
owned directories.
Comment 3 Eric Schirra 2017-05-22 18:05:37 UTC
I have fixed the rights for directory.
Nobody but wwwrun have rights for the directories app, config, data.
I want split whole packages in different dirs.
Beacuse in other packages, like phpmyadmin, it is also not split.
And it would break all documentations wich can be found on internet.
And i'm not a friend of massiv changes against upstream.

When still not okay, please make a new issue with open failure.
Comment 4 Bernhard Wiedemann 2017-09-04 12:01:52 UTC
This is an autogenerated message for OBS integration:
This bug (1036756) was mentioned in
https://build.opensuse.org/request/show/520643 42.3 / nextcloud
Comment 5 Andreas Stieger 2017-09-08 13:37:47 UTC
It looks like the 12 version was submitted into Leap Maintenance, I did not like this, at least not without another tracking bug.

This submission fixes this minor vulnerability:
https://build.opensuse.org/request/show/522326

As for version 12, please say if you want to have this new version considered.
Comment 6 Bernhard Wiedemann 2017-09-09 06:00:32 UTC
This is an autogenerated message for OBS integration:
This bug (1036756) was mentioned in
https://build.opensuse.org/request/show/522719 42.3 / nextcloud
Comment 7 Eric Schirra 2017-09-10 16:49:43 UTC
Why reopened?
Issue is fixed as requested.
Comment 8 Andreas Stieger 2017-09-11 07:47:25 UTC
It was re-opened because of what I wrote in comment #5.
The version 12 update is not required to fix this for Leap Maintenance, but please check this one: https://build.opensuse.org/request/show/522326
Comment 9 Andreas Stieger 2017-09-12 18:38:18 UTC
Can you please review https://build.opensuse.org/request/show/522719
or indicate that you want to put put a maintenance update to the latest release, for which we need another bug?
Comment 10 Andreas Stieger 2017-09-17 18:58:31 UTC
Not progressing version update without separate bug.
Please provide a back-port for maintenance, since you declined mine.
Comment 11 Eric Schirra 2017-09-28 07:15:52 UTC
maintenance request is on the way
Comment 12 Marcus Meissner 2017-09-28 09:06:34 UTC
CVE-2017-9286 for the /tmp races.
Comment 13 Bernhard Wiedemann 2017-09-29 06:00:59 UTC
This is an autogenerated message for OBS integration:
This bug (1036756) was mentioned in
https://build.opensuse.org/request/show/529082 42.3 / nextcloud
Comment 14 Eric Schirra 2017-10-03 09:32:10 UTC
(In reply to Bernhard Wiedemann from comment #13)
> This is an autogenerated message for OBS integration:
> This bug (1036756) was mentioned in
> https://build.opensuse.org/request/show/529082 42.3 / nextcloud

So it's now over 5 days in maintenance and on the way, but not in Update.
Can i close this issue or should i wait?
Comment 15 Andreas Stieger 2017-10-03 19:28:19 UTC
You can just assign it back to the security team.
Comment 16 Andreas Stieger 2017-10-03 19:28:46 UTC
releasing update
Comment 17 Swamp Workflow Management 2017-10-04 01:07:31 UTC
openSUSE-SU-2017:2641-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1036756
CVE References: CVE-2017-9286
Sources used:
openSUSE Leap 42.3 (src):    nextcloud-11.0.3-3.1
Comment 18 Swamp Workflow Management 2018-07-10 08:50:06 UTC
This is an autogenerated message for OBS integration:
This bug (1036756) was mentioned in
https://build.opensuse.org/request/show/621840 Backports:SLE-12 / nextcloud
Comment 19 Swamp Workflow Management 2019-02-12 13:40:07 UTC
This is an autogenerated message for OBS integration:
This bug (1036756) was mentioned in
https://build.opensuse.org/request/show/673824 15.1 / nextcloud