Bug 1811703 (CVE-2019-3695)

Summary:	CVE-2019-3695 pcp: Local privilege escalation in pcp spec file %post section
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agerstmayr, jkurik, mgoodwin, nathans, patrickm, pcp-maint
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pcp-5.0.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 22:00:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1723598, 1811704, 1815249, 1815250
Bug Blocks:	1811711

Description Pedro Sampaio 2020-03-09 15:16:25 UTC

A Improper Control of Generation of Code vulnerability in the rpm packaging of pcp allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1152763

Comment 1 Pedro Sampaio 2020-03-09 15:16:51 UTC

Created pcp tracking bugs for this issue:

Affects: fedora-all [bug 1811704]

Comment 2 Nathan Scott 2020-03-10 02:30:56 UTC

This issue was resolved some time ago by removing compatibility code in PCP v5 - all current Fedora versions are unaffected by the issue.

commit 34c83f7ee46224fe410572f33c57a739f7bd044f
Author: Nathan Scott <nathans>
Date:   Sun Oct 6 14:10:40 2019 +1100

    build: drop old config file transition code from rpm specs
    
    Its been many years since this transition was done, good time
    now with pcp-5.0.0 to full this old shell code.  Also remove
    the Fedora crontab transition logic as thats completely moved
    over to systemd now.

Comment 3 Riccardo Schirone 2020-03-10 08:22:46 UTC

Please do not close this bug as this is not only Fedora specific, but it is used to describe the flaw.
For the Fedora tracker see bug 1811704.

Comment 4 Nathan Scott 2020-03-10 17:43:05 UTC

Ah, my mistake - apologies.  What information do you need from me?  (needinfo? set)

Comment 5 Nathan Scott 2020-03-16 04:11:21 UTC

AFAICT nothing more is needed from me at this time, clearing 'needinfo'.

Comment 7 Marco Benatto 2020-03-19 19:49:55 UTC

Upstream commit for this issue:
https://github.com/performancecopilot/pcp/commit/34c83f7ee46224fe410572f33c57a739f7bd044f

Comment 8 Marco Benatto 2020-03-20 13:36:49 UTC

There's an issue with pcp package, during pre installation phase the rpm copies some scripts from predetermined locations. Those scripts are further installed with permission to be executed as root user during post installation phase. An attacker may leverage this flaw by adding malicious code on certain scripts or manipulating those file paths, resulting in privilege escalation during package installation.

Comment 9 errata-xmlrpc 2020-09-29 19:24:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3869 https://access.redhat.com/errata/RHSA-2020:3869

Comment 10 Product Security DevOps Team 2020-09-29 22:00:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3695