Bug 1483617 (CVE-2017-12419)

Summary:	CVE-2017-12419 mantis: Arbitrary file read via MySQL's "connect file read" feature
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	giallu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:21:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1483618
Bug Blocks:

Description Adam Mariš 2017-08-21 13:27:08 UTC

If, after successful installation of MantisBT through 2.5.2 on
MySQL/MariaDB, the administrator does not remove the 'admin' directory
(as recommended in the "Post-installation and upgrade tasks" section of
the MantisBT Admin Guide), and the MySQL client has a local_infile
setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL
client config file, depending on the PHP setup), an attacker may take
advantage of MySQL's "connect file read" feature to remotely access
files on the MantisBT server.

Upstream bug:

https://mantisbt.org/bugs/view.php?id=23173

Comment 1 Adam Mariš 2017-08-21 13:27:32 UTC

Created mantis tracking bugs for this issue:

Affects: fedora-all [bug 1483618]

Comment 2 Gianluca Sforna 2017-08-22 08:45:10 UTC

So, the mantis RPM package ships with an Apache directive that disallow access to the admin/ directory by default:

<Directory /usr/share/mantis/admin>
	Order   Deny,Allow
	Deny    from All
	Allow   from None
</Directory>

So my guess is that we are not affected by the issue in our default configuration.

Comment 3 Adam Mariš 2017-08-30 15:11:14 UTC

(In reply to Gianluca Sforna from comment #2)
> So, the mantis RPM package ships with an Apache directive that disallow
> access to the admin/ directory by default:
> 
> <Directory /usr/share/mantis/admin>
> 	Order   Deny,Allow
> 	Deny    from All
> 	Allow   from None
> </Directory>
> 
> So my guess is that we are not affected by the issue in our default
> configuration.

You seem to be right. Feel free to close Fedora tracker then. Thanks for looking into it!

Comment 4 Product Security DevOps Team 2019-06-08 03:21:44 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.