Bug 1212953 (CVE-2015-3147) - CVE-2015-3147 abrt: does not validate contents of uploaded problem reports
Summary: CVE-2015-3147 abrt: does not validate contents of uploaded problem reports
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-3147
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1211966 1211967 1218583 1238724
Blocks: 1211224 1214172
TreeView+ depends on / blocked
 
Reported: 2015-04-17 18:40 UTC by Florian Weimer
Modified: 2019-09-29 13:31 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT, or to overwrite arbitrary files on the system.
Clone Of:
Environment:
Last Closed: 2015-07-09 05:34:52 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1083 normal SHIPPED_LIVE Important: abrt security update 2015-06-09 23:48:24 UTC
Red Hat Product Errata RHSA-2015:1210 normal SHIPPED_LIVE Moderate: abrt security update 2015-07-07 12:39:40 UTC

Description Florian Weimer 2015-04-17 18:40:07 UTC 
It was discovered that, when moving problem reports from
/var/spool/abrt-upload to /var/spool/abrt or /var/tmp/abrt,
abrt-handle-upload does not verify that the new problem directory has
appropriate permissions and does not contain symbolic links.  A crafted
problem report exposes other parts of abrt to attack, and the
abrt-handle-upload script allows to overwrite arbitrary files.

Acknowledgement:

This issue was discovered by Florian Weimer of Red Hat Product Security.
Comment 1 Florian Weimer 2015-04-17 18:42:01 UTC 
abrt itself does not accept crash uploads over the network, it relies on some sort of file transfer to /var/spool/abrt-upload.  By default, this directory has restrictive write permissions, so this functionality is not exposed to users.  As a result, this vulnerability does not affect default configurations.
Comment 3 Jakub Filak 2015-04-20 13:35:34 UTC 
I've opened the following upstream pull request for this CVE:
https://github.com/abrt/abrt/pull/955
Comment 4 Florian Weimer 2015-04-20 14:19:17 UTC 
(In reply to Jakub Filak from comment #3)
> I've opened the following upstream pull request for this CVE:
> https://github.com/abrt/abrt/pull/955

Thanks, see my Github comments.  In short, the directory permissions are unclear, and there seems to be race between the validation and the renaming.
Comment 5 Jakub Filak 2015-04-21 06:42:55 UTC 
(In reply to Florian Weimer from comment #4)
> (In reply to Jakub Filak from comment #3)
> > I've opened the following upstream pull request for this CVE:
> > https://github.com/abrt/abrt/pull/955
> 
> Thanks, see my Github comments.  In short, the directory permissions are
> unclear, and there seems to be race between the validation and the renaming.

Thank you! I've updated the pull request and added a comment about the directory permissions.
Comment 7 Jakub Filak 2015-05-05 11:20:43 UTC 
Upstream commit https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091 fixes this bug.
Comment 8 errata-xmlrpc 2015-06-09 19:49:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1083 https://rhn.redhat.com/errata/RHSA-2015-1083.html
Comment 10 errata-xmlrpc 2015-07-07 08:40:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1210 https://rhn.redhat.com/errata/RHSA-2015-1210.html
Note You need to log in before you can comment on or make changes to this bug.