Bug 1015228 (CVE-2013-4400)

Summary:	CVE-2013-4400 libvirt: virt-login-shell arbitrary file overwrites vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acathrow, berrange, eblake, jdenemar, pfrields, pmatouse, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-10-03 17:54:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1015247, 1025685
Bug Blocks:

Description Vincent Danen 2013-10-03 17:13:00 UTC

It was reported that virt-login-shell, an suid-root program, did not sanitize its environment variables or command-line interface arguments properly.  This could allow a local user to overwrite arbitrary files as root and elevate their privileges.

This vulnerability was introduced in libvirt 1.1.2.


Acknowledgements:

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.

Comment 1 Vincent Danen 2013-10-03 17:52:37 UTC

Statement:

Not vulnerable.

This issue did not affect the versions of libvirt package as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 3 Petr Matousek 2013-10-21 15:55:40 UTC

Upstream commits:

http://libvirt.org/git/?p=libvirt.git;a=commit;h=8c3586ea755c40d5e01b22cb7b5c1e668cdec994
http://libvirt.org/git/?p=libvirt.git;a=commit;h=b7fcc799ad5d8f3e55b89b94e599903e3c092467
http://libvirt.org/git/?p=libvirt.git;a=commit;h=3e2f27e13b94f7302ad948bcacb5e02c859a25fc

Comment 4 Petr Matousek 2013-11-01 09:43:56 UTC

Created libvirt tracking bugs for this issue:

Affects: fedora-all [bug 1025685]

Comment 5 Fedora Update System 2013-11-12 00:36:10 UTC

libvirt-1.1.3.1-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.