Bug 697848

Summary:	atop: Symlink attacks via process accounting file
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gilboad, kairo, manuel.wolfshant
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-04-19 16:20:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	697851, 697852, 697853
Bug Blocks:

Description Jan Lieskovsky 2011-04-19 12:53:55 UTC

atop v1.23 and earlier created process accounting file (/tmp/atop.d/atop.acct)
in an insecure way. A local attacker could use this flaw to conduct symlink
attacks (e.g. overwrite arbitrary system files).

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622794
[2] http://secunia.com/advisories/44175/

Comment 1 Jan Lieskovsky 2011-04-19 13:00:01 UTC

This issue affects the versions of the atop package, as shipped
with Fedora release of 13 and 14.

This issue affects the versions of the atop package, as present
within EPEL-4 and EPEL-5 repositories.

Please schedule an update once final upstream patch ready / known.

Comment 2 Jan Lieskovsky 2011-04-19 13:01:28 UTC

CVE Request:
[3] http://www.openwall.com/lists/oss-security/2011/04/19/2

Comment 3 Jan Lieskovsky 2011-04-19 13:03:26 UTC

Created atop tracking bugs for this issue

Affects: epel-4 [bug 697851]
Affects: epel-5 [bug 697852]
Affects: fedora-all [bug 697853]

Comment 4 Jan Lieskovsky 2011-04-19 16:20:31 UTC

Closing as not an issue due this:
[4] http://www.openwall.com/lists/oss-security/2011/04/19/3