Bug 484065 (CVE-2009-0415)

Summary: CVE-2009-0415 trickle: Possibility to load arbitrary code from current working directory
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NEXTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: manuel.wolfshant, mtasaka, nicoleau.fabien
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-02-25 21:11:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-02-04 16:07:41 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0415 to
the following vulnerability:

Untrusted search path vulnerability in trickle 1.07 allows local users
to execute arbitrary code via a Trojan horse trickle-overload.so in
the current working directory, which is referenced in the LD_PRELOAD
path.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0415
http://www.openwall.com/lists/oss-security/2009/01/29/5
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456
http://www.securityfocus.com/bid/33516
Comment 1 Jan Lieskovsky 2009-02-04 16:08:46 UTC 
This issue affects all versions of the trickle package, as shipped
with Fedora releases of 9, 10 and devel.

Please fix.
Comment 3 Nicoleau Fabien 2009-02-04 16:38:50 UTC 
As the package provides trickle-overload.so in %libdir/trickle/ , I think I can juste patch trickle.c and change :
	char *trypaths[]  = {
		LIBNAME,
		LIBDIR "/" LIBNAME,
		NULL
	};

to 

	char *trypaths[]  = {
		LIBDIR "/" LIBNAME,
		NULL
	};
Comment 4 analyzer 2009-02-04 16:41:26 UTC 
seems ok to me !
or perhaps just change priority:
char *trypaths[]  = {
  LIBDIR "/" LIBNAME,
  LIBNAME,
  NULL
 };
Comment 5 Nicoleau Fabien 2009-02-06 21:45:06 UTC 
As no patch seems available atm, I'll remove "LIBNAME" from "trypath"
Comment 6 Nicoleau Fabien 2009-02-09 12:27:33 UTC 
Don't know why bodhi did not update this bug.
The update is available for F9 and F10 in updates-testing repository
Comment 7 Tomas Hoger 2009-02-12 15:56:58 UTC 
Looking at the change that was used:
http://cvs.fedoraproject.org/viewvc/rpms/trickle/devel/trickle.spec?r1=1.3&r2=1.4

This fix looks quite fragile to me, as any future change to the trickle.c (e.g. future version update) can easily cause the offending line to change it's position in the file and result it deletion some other line (that may or may not be caught during the compile).  Regex-controlled deletion may be slightly better, standalone diff still sounds like the safest alternative.
Comment 8 Nicoleau Fabien 2009-02-12 20:40:31 UTC 
That's true. I pushed a new release with a patch instead of a sed.
Comment 9 Fedora Update System 2009-02-24 20:43:39 UTC 
trickle-1.07-7.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2009-02-24 20:59:56 UTC 
trickle-1.07-7.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Nicoleau Fabien 2009-02-25 21:11:25 UTC 
It seems that koji does not close this bug, so I do it myself.