Bug 1487543 (CVE-2017-14102)

Summary:	CVE-2017-14102 mimedefang: Privilege escalation via PID file manipulation
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mimedefang 2.81	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:23:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1487544, 1487545
Bug Blocks:

Description Adam Mariš 2017-09-01 08:47:48 UTC

MIMEDefang 2.80 and earlier creates a PID file after dropping
privileges to a non-root account, which might allow local users to kill
arbitrary processes by leveraging access to this non-root account for
PID file modification before a root script executes a "kill `cat
/pathname`" command, as demonstrated by the init-script.in and
mimedefang-init.in scripts.

Bug report:

http://lists.roaringpenguin.com/pipermail/mimedefang/2017-August/038077.html

Proposed patch:

http://lists.roaringpenguin.com/pipermail/mimedefang/2017-August/038085.html

Comment 1 Adam Mariš 2017-09-01 08:48:09 UTC

Created mimedefang tracking bugs for this issue:

Affects: epel-all [bug 1487544]
Affects: fedora-all [bug 1487545]

Comment 2 Robert Scheck 2017-09-01 08:59:02 UTC

Adam, would it be okay to move the PID files to /var/run while keeping the
lock files in /var/spool/MIMEDefang further on?

Comment 3 Robert Scheck 2017-09-03 21:48:08 UTC

That's how it is now: https://src.fedoraproject.org/rpms/mimedefang/blob/92a41edb3d089fead60cbe2469a0fcd76136b8d3/f/mimedefang-wrapper

Comment 4 Adam Mariš 2017-09-04 13:13:11 UTC

(In reply to Robert Scheck from comment #2)
> Adam, would it be okay to move the PID files to /var/run while keeping the
> lock files in /var/spool/MIMEDefang further on?

Yes, that seems to be more suitable place for pid files.

Comment 5 Product Security DevOps Team 2019-06-08 03:23:40 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.