Bug 1811707 (CVE-2019-3696)

Summary:	CVE-2019-3696 pcp: Local privilege escalation in pcp spec file through migrate_tempdirs
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agerstmayr, brolley, fche, jkurik, lberk, mbenatto, mgoodwin, nathans, patrickm, pcp-maint
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pcp-5.0.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 22:00:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1723598, 1811710, 1815528, 1815529
Bug Blocks:	1811711

Description Pedro Sampaio 2020-03-09 15:26:31 UTC

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the rpm packaging of pcp allows local user pcp to overwrite arbitrary files with arbitrary content.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1153921

Comment 1 Pedro Sampaio 2020-03-09 15:27:00 UTC

Created pcp tracking bugs for this issue:

Affects: fedora-all [bug 1811710]

Comment 2 Nathan Scott 2020-03-10 02:31:04 UTC

This issue was resolved some time ago by removing compatibility code in PCP v5 - all current Fedora versions are unaffected by the issue.

commit 34c83f7ee46224fe410572f33c57a739f7bd044f
Author: Nathan Scott <nathans>
Date:   Sun Oct 6 14:10:40 2019 +1100

    build: drop old config file transition code from rpm specs
    
    Its been many years since this transition was done, good time
    now with pcp-5.0.0 to full this old shell code.  Also remove
    the Fedora crontab transition logic as thats completely moved
    over to systemd now.

Comment 3 Riccardo Schirone 2020-03-10 08:23:35 UTC

Please do not close this bug as this is not only Fedora specific, but it is used to describe the flaw.
For the Fedora tracker see bug 1811710.

Comment 6 Marco Benatto 2020-03-20 13:59:04 UTC

Upstream commit for this issue:
https://github.com/performancecopilot/pcp/commit/34c83f7ee46224fe410572f33c57a739f7bd044f

Comment 7 Marco Benatto 2020-03-20 14:04:06 UTC

Currently pcp package during pre installation phase doesn't perform a proper file path check while saving existing configuration files, this allows an attacker to overwrite any existing files on this system, or create new ones by manipulating file paths. Local access and minimal privileges to perform basic file operations. Depending on how the attack is crafted this may result in high confidentiality, integrity and availability impact. A successful attack depends on user installing, reinstalling or upgrading the pcp package, thus User Interaction is set as required.

Comment 8 Nathan Scott 2020-03-24 00:34:39 UTC

(In reply to Marco Benatto from comment #7)
> by manipulating file paths. Local access and minimal privileges to perform
> basic file operations.
> [...]
> successful attack depends on user installing, reinstalling or upgrading the
> pcp package, thus User Interaction is set as required.

Note an attacker must also compromise the (system) account 'pcp' in order to
write to /var/log/pcp ($PCP_LOG_DIR), from whence config.sh is sourced.

Comment 9 errata-xmlrpc 2020-09-29 19:24:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3869 https://access.redhat.com/errata/RHSA-2020:3869

Comment 10 Product Security DevOps Team 2020-09-29 22:00:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3696