Bug 1480550 (CVE-2017-7560)

Summary:	CVE-2017-7560 rhnsd: World-writable PID files
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	msuchy, rasanche, security-response-team, tkasparek, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-22 08:18:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1480879, 1480880, 1480881, 1480882
Bug Blocks:	1480551

Description Adam Mariš 2017-08-11 11:22:22 UTC

It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.

Issue was reportedly introduced by commit 75d9c00b96ab430221c5c7668baebebc74ddd67e

Comment 3 Tomas Lestach 2017-08-21 13:46:51 UTC

RHEL7 BZ: Bug 1480306

Comment 4 Raphael Sanchez Prudencio 2017-08-22 08:18:59 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.