Bug 439687 (CVE-2008-1614)
| Summary: | CVE-2008-1614 mod_suphp: local privilege escalation through symlinks | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Felix Schwarz <fschwarz> | ||||
| Component: | mod_suphp | Assignee: | Andreas Thienemann <andreas> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | rawhide | CC: | wouter | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | 0.6.3-1.fc7 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2008-04-01 21:32:36 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Felix Schwarz
2008-03-30 14:21:26 UTC
Unfortunately, I don't know any public version control system for mod_suphp.
This means it is quite hard to isolate the code fixing the described problems.
For Fedora we can just update to 0.6.3 but EPEL should get a backport.
Therefore I examined the releases 0.6.2 and 0.6.3 for changes ('diff --recursive
-u --exclude="aclocal*" --exclude="config*" --exclude="Makefile*"
--exclude=ChangeLog --exclude=INSTALL suphp-0.6.2 suphp-0.6.3 > diff.patch').
The resulting diff is ~11 kB big but it seems to me that the only source code
changes since 0.6.2 were the mentioned fixes for the upstream problems. (I won't
attach the diff here as it is easy to recreate.)
Therefore I don't see a point backporting the fixes (and risk not fixing the
problems correctly).
https://ssl.marsching.biz/subversion/suphp/ However, there's no interface available AFAIK like trac or viewsvn. I'd really like to see a fast fix for this problem, especially for Fedora 7 + 8. You're right about 0.6.2 vs. 0.6.3 : the only change is this fix, and some automake fixes. I'll attach the diff anyway. Created attachment 299694 [details]
Fixes symlink checks
mod_suphp-0.6.3-1.fc7 has been submitted as an update for Fedora 7 mod_suphp-0.6.3-1.fc8 has been submitted as an update for Fedora 8 mod_suphp-0.6.3-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report. mod_suphp-0.6.3-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. |