Bug 489355 (CVE-2009-2737)

Summary: CVE-2009-2737 roundup: privilege escalation in EditCSVAction
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: i
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-08-11 10:26:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 489356, 489357    
Bug Blocks:    
Attachments:
Description Flags
patch from Debian's BTS to fix the issue none

Description Vincent Danen 2009-03-09 16:44:23 UTC 
It was found that any user able to create or edit queries in roundup is able to edit all queries (delete or modify other user's queries).  This is due to EditCSVAction not having the same level of control over queries that SearchAction does (both in cgi/actions.py).  This gives users admin-level power over other user's queries.

The upstream bug report is here: http://issues.roundup-tracker.org/issue2550521 and the Debian bug report is here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768

The recommended fix from upstream is to disable EditCSVAction altogether.
Comment 1 Vincent Danen 2009-03-09 16:44:47 UTC 
Created roundup tracking bugs for this issue

Affects: F10 [bug #489356]
Affects: F9 [bug #489357]
Comment 3 Vincent Danen 2009-03-09 16:47:03 UTC 
Created attachment 334557 [details]
patch from Debian's BTS to fix the issue

This patch disables EditCSVAction.
Comment 4 Fedora Update System 2009-03-11 17:57:25 UTC 
roundup-1.4.6-4.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2009-03-11 17:58:22 UTC 
roundup-1.4.6-4.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Tomas Hoger 2009-08-11 10:26:20 UTC 
CVE-2009-2737:
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before
1.2.1, 1.4 through 1.4.6, and possibly other versions does not
properly check permissions, which allows remote authenticated users
with edit or create privileges for a class to modify arbitrary items
within that class, as demonstrated by editing all queries, modifying
settings, and adding roles to users.