Bug 1008313 (CVE-2013-4362)

Summary: CVE-2013-4362 davfs2: insecure use of system()
Product: [Other] Security Response Reporter: Ratul Gupta <ratulg>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jrusnack, wwoods
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20130915,reported=20130916,source=debian,cvss2=6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C,fedora-all/davfs2=affected,cwe=CWE-676
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-12 06:01:13 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 1012340    
Bug Blocks: 1008316    

Description Ratul Gupta 2013-09-16 02:54:18 EDT
It is found that davfs2, a tool for connecting to WebDAV, might be using the system() insecurely. The issue is since mount_davfs2 is setuid, using the system() call could result in privilege escalation.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=723034
Comment 1 Will Woods 2013-09-19 17:00:02 EDT
I'm building davfs-1.4.7-3.fc{18,19,20}, which includes the patch from upstream for this. Let me know if there's anything special I need to do here.
Comment 2 Ratul Gupta 2013-09-26 06:13:07 EDT
Created davfs2 tracking bugs for this issue:

Affects: fedora-all [bug 1012340]
Comment 3 Fedora Update System 2013-11-10 01:40:28 EST
davfs2-1.4.7-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.