This service will be undergoing maintenance at 03:30 UTC, 2016-05-27. It is expected to last about 2 hours

Bug 1002299 (CVE-2013-5648)

Summary: CVE-2013-5648 libdigidoc: arbitrary file overwrite flaw
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: antti.andreimann, jrusnack, kalevlember, tuju
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130822,reported=20130828,source=mageia,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,fedora-all/libdigidoc=affected,cwe=CWE-22
Fixed In Version: libdigidoc 3.7.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-11-26 09:13:58 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 1002302    
Bug Blocks:    

Description Vincent Danen 2013-08-28 16:34:33 EDT
It was reported [1],[2] that ID-software 3.7.2 (libdigidoc):

"Fixed one critical bug in the DDOC parsing routines. By persuading a victim to open a specially-crafted DDOC file, a remote attacker could exploit this vulnerability to overwrite arbitrary files on the system with the privileges of the victim."

The patch is in svn (not the repository from code.google.com/p/esteid, but from svn.eesti.ee) [3] (r98).  This patch was backported for Mageia [4] and looks applicable to what we ship in Fedora (although we have a much older version).  The patch from Mageia (or upstream) won't apply without changes, however, as it's adding a new error code.  Judging from the patch, it's just making sure that the file name doesn't include '/' or '\\' (so no paths in the filename).


[1] http://www.id.ee/?lang=en&id=34283#3_7_2
[2] https://bugs.mageia.org/show_bug.cgi?id=11100
[3] https://svn.eesti.ee/projektid/idkaart_public/
[4] http://svnweb.mageia.org/packages/updates/3/libdigidoc/current/SOURCES/libdigidoc-3.6.0.0-security-fix-DataFile-name-tag.patch?revision=472660&view=markup
Comment 1 Vincent Danen 2013-08-28 16:37:11 EDT
Created libdigidoc tracking bugs for this issue:

Affects: fedora-all [bug 1002302]
Comment 2 Vincent Danen 2013-08-29 00:55:55 EDT
This issue was assigned the name CVE-2013-5648:

http://www.openwall.com/lists/oss-security/2013/08/29/2
Comment 3 Fedora Update System 2014-11-18 07:20:59 EST
libdigidoc-3.9.1.1191-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.