Bug 1062722 - (CVE-2017-14798) VUL-0: CVE-2017-14798: postgresql-init: LPE via postgres init script
VUL-0: CVE-2017-14798: postgresql-init: LPE via postgres init script
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
Depends on: CVE-2017-12172
  Show dependency treegraph
Reported: 2017-10-11 09:20 UTC by Johannes Segitz
Modified: 2020-08-13 09:55 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2017-10-11 09:20:18 UTC
Created attachment 743849 [details]

Problematic use of install allows LPE from postgres user to root.

Make public when 1062538 goes public
Comment 2 Reinhard Max 2017-10-11 11:17:03 UTC
Actually, things are even easier, because creation of the data dir before calling initdb is not needed (anymore). I just checked that initdb creates the dir if it doesn't yet exist and also locks down the permissions to 700 if it exists with more relaxed permissions.

So, the new proposed patch would be:
--- postgresql-init     (revision 45eea42cac80ba1bfc18b4c7a5f53e90)
+++ postgresql-init     (working copy)
@@ -98,7 +98,6 @@
             V=$(printf "%02d%02d" $(echo $VERSION|awk -F. '{print $1, $2}'))
             AUTH="ident"; test $V -lt 0900 && AUTH="ident sameuser"
-           install -d -o postgres -g postgres -m 700 ${DATADIR} &&
             su - postgres -c \
                 "$INITDB --locale=$LANG --auth=\"$AUTH\" $DATADIR &> initlog" ||
Comment 4 Swamp Workflow Management 2017-11-27 21:20:41 UTC
SUSE-SU-2017:3107-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1062722
CVE References: CVE-2017-14798
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    postgresql-init-9.4-
Comment 5 Marcus Meissner 2018-01-15 10:41:48 UTC