Bug 1002299 (CVE-2013-5648)

Summary: CVE-2013-5648 libdigidoc: arbitrary file overwrite flaw
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: antti.andreimann, jrusnack, kalevlember, tuju
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130822,reported=20130828,source=mageia,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,fedora-all/libdigidoc=affected,cwe=CWE-22
Fixed In Version: libdigidoc 3.7.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-11-26 09:13:58 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1002302    
Bug Blocks:    

Description Vincent Danen 2013-08-28 16:34:33 EDT
It was reported [1],[2] that ID-software 3.7.2 (libdigidoc):

"Fixed one critical bug in the DDOC parsing routines. By persuading a victim to open a specially-crafted DDOC file, a remote attacker could exploit this vulnerability to overwrite arbitrary files on the system with the privileges of the victim."

The patch is in svn (not the repository from code.google.com/p/esteid, but from svn.eesti.ee) [3] (r98).  This patch was backported for Mageia [4] and looks applicable to what we ship in Fedora (although we have a much older version).  The patch from Mageia (or upstream) won't apply without changes, however, as it's adding a new error code.  Judging from the patch, it's just making sure that the file name doesn't include '/' or '\\' (so no paths in the filename).

[1] http://www.id.ee/?lang=en&id=34283#3_7_2
[2] https://bugs.mageia.org/show_bug.cgi?id=11100
[3] https://svn.eesti.ee/projektid/idkaart_public/
[4] http://svnweb.mageia.org/packages/updates/3/libdigidoc/current/SOURCES/libdigidoc-
Comment 1 Vincent Danen 2013-08-28 16:37:11 EDT
Created libdigidoc tracking bugs for this issue:

Affects: fedora-all [bug 1002302]
Comment 2 Vincent Danen 2013-08-29 00:55:55 EDT
This issue was assigned the name CVE-2013-5648:

Comment 3 Fedora Update System 2014-11-18 07:20:59 EST
libdigidoc- has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.