Bug 959434
Summary: | libbluray (MountManager): Directory traversal when expanding certain JAR files | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED NOTABUG | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | bnocera, dkholia, dmoppert, fweimer, jlieskov, security-response-team, xavier |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-10-05 04:47:55 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 959238, 1381796, 1381797 | ||
Bug Blocks: | 959437 |
Description
Jan Lieskovsky
2013-05-03 13:15:52 UTC
This issue affects the versions of the libbluray package, as shipped with Fedora release of 17, 18, and Fedora EPEL-6. From the original report by Florian Weimer: The other problem is that this code further below does not guard against directory traversal attacks from a malicious JAR file: File out = new File(tmpDir + File.separator + entry.getName()); if (entry.isDirectory()) { out.mkdir(); } else { InputStream inStream = jar.getInputStream(entry); OutputStream outStream = new FileOutputStream(out); while (inStream.available() > 0) { outStream.write(inStream.read()); } inStream.close(); outStream.close(); } Created libbluray tracking bugs for this issue: Affects: fedora-all [bug 1381796] Affects: epel-6 [bug 1381797] I'm confused on the status of this bug. It was closed as NOTABUG, but there was no comment as to why. Is the issue still current or not ? Fedora has a newer version than EL7, so I guess its' not affected (https://bugzilla.redhat.com/show_bug.cgi?id=1381796). EPEL6 might still have the issue as the version is earlier than EL7 and wasn't updated due to soname bump (https://bugzilla.redhat.com/show_bug.cgi?id=1381797). The NOTABUG status reflects Red Hat products (EL7 in this case). In "Depends On", you can see bugs were filed for Fedora and EPEL respectively. |