Bug 1516915 (CVE-2017-15288)

Summary:	CVE-2017-15288 scala: Privilege escalation in Scala compilation daemon
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, chazlett, drieden, geoff+fedora, gvarsami, hghasemb, hhorak, java-maint, jcoleman, jochen, jolee, jorton, jschatte, jstastny, kconner, ldimaggi, mizdebsk, nwallace, pavelp, rwagner, tcunning, tkirby, vhalbert, willb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Scala 2.10.7, Scala 2.11.12, Scala 2.12.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-27 18:21:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1516916
Bug Blocks:	1516920

Description Pedro Sampaio 2017-11-23 14:54:59 UTC

A flaw was found in Scala versions 2.1.6-2.10.6; 2.11.0-2.11.11; 2.12.0-2.12.3. An insecure use of temporary files may permit privilege escalation through the compile daemon leading to code execution and arbitrary class files writing as the user that started the daemon.

Upstream bug:

https://github.com/scala/scala/pull/6108

Upstream patch:

https://github.com/scala/scala/pull/6108/commits/b64ad85d1cfdfff29d0836a66736d6d2b0830c0e

References:

http://scala-lang.org/news/security-update-nov17.html

Comment 1 Pedro Sampaio 2017-11-23 14:55:57 UTC

Created scala tracking bugs for this issue:

Affects: fedora-all [bug 1516916]

Comment 2 Dhiru Kholia 2018-01-23 06:58:16 UTC

Mitigation:

1. Use "scala -nocompdaemon MyScript.scala" rather than "scala MyScript.scala" to disable the implicit startup and use of the daemon.

2. Avoid explicitly starting fsc.

This text is borrowed from the upstream security advisory.