Bug 1434100 (CVE-2017-2663)

Summary:	CVE-2017-2663 subscription-manager: unsafe dbus interface
Product:	[Other] Security Response	Reporter:	Cedric Buissart <cbuissar>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alikins, awood, bkearney, candlepin-bugs, redakkan, skallesh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	subscription-manager 1.19.4	Doc Type:	If docs needed, set a value
Doc Text:	It was found that subscription-manager's DBus interface let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-22 08:51:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1434493
Bug Blocks:	1433383

Description Cedric Buissart 2017-03-20 17:35:18 UTC

Subscription-manager's new DBus interface allows unprivileged local user to have access to information known to root only, and/or to modify subscription-manager configuration file.
An attacker could use this flaw to escalate its privileges, or to gain access to private information.

Commit enabling the dbus interface (subscription-manager-1.19.0) :
https://github.com/candlepin/subscription-manager/commit/2aa48ef65

Comment 1 Cedric Buissart 2017-03-21 10:18:03 UTC

Required patches :
 * Lock down Facts object to be accessible to root only.
https://github.com/candlepin/subscription-manager/commit/882bb587a
 * 1434094: Deny D-BUS Config.Set from non-root
https://github.com/candlepin/subscription-manager/commit/afa0f7afee

Comment 2 Cedric Buissart 2017-03-21 15:43:25 UTC

Created subscription-manager tracking bugs for this issue:

Affects: fedora-all [bug 1434493]

Comment 3 Cedric Buissart 2017-03-21 15:45:59 UTC

Statement:

This issue did not affect the versions of subscription-manager as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include support for the DBus interface.

Comment 4 Cedric Buissart 2017-03-21 16:27:00 UTC

Acknowledgments:

Name: Cedric Buissart (Red Hat)