Bug 988998 (CVE-2013-4481)

Summary:	CVE-2013-4481 luci: short exposure of authentication secrets while generating configuration file
Product:	[Other] Security Response	Reporter:	Jan Pokorný [poki] <jpokorny>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fdinitto, jkurik, rmccabe, rsteiger, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A flaw was found in the way luci generated its configuration file. The file was created as world readable for a short period of time, allowing a local user to gain access to the authentication secrets stored in the configuration file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-21 14:25:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1005385
Bug Blocks:	974906, 990750

Comment 2 Vincent Danen 2013-08-08 19:29:39 UTC

It was discovered that the luci configuration file was generated in an insecure manner.  Because the configuration is generated on-demand via the luci initscript from a template, and because it is created and then has its permissions changed, the /var/lib/luci/etc/luci.ini file contents are briefly exposed to local users due to world-readable permissions.


Acknowledgements:

This issue was discovered by Jan Pokorný of Red Hat.

Comment 12 Tomas Hoger 2013-11-20 19:01:43 UTC

Lifting embargo.

Comment 13 errata-xmlrpc 2013-11-21 10:33:27 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:1603 https://rhn.redhat.com/errata/RHSA-2013-1603.html