Bug 1811703 (CVE-2019-3695) - CVE-2019-3695 pcp: Local privilege escalation in pcp spec file %post section
Summary: CVE-2019-3695 pcp: Local privilege escalation in pcp spec file %post section
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-3695
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1723598 1811704 1815249 1815250
Blocks: 1811711
TreeView+ depends on / blocked
 
Reported: 2020-03-09 15:16 UTC by Pedro Sampaio
Modified: 2020-09-29 22:00 UTC (History)
6 users (show)

Fixed In Version: pcp-5.0.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-09-29 22:00:01 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3869 0 None None None 2020-09-29 19:24:19 UTC

Description Pedro Sampaio 2020-03-09 15:16:25 UTC
A Improper Control of Generation of Code vulnerability in the rpm packaging of pcp allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1152763

Comment 1 Pedro Sampaio 2020-03-09 15:16:51 UTC
Created pcp tracking bugs for this issue:

Affects: fedora-all [bug 1811704]

Comment 2 Nathan Scott 2020-03-10 02:30:56 UTC
This issue was resolved some time ago by removing compatibility code in PCP v5 - all current Fedora versions are unaffected by the issue.

commit 34c83f7ee46224fe410572f33c57a739f7bd044f
Author: Nathan Scott <nathans@redhat.com>
Date:   Sun Oct 6 14:10:40 2019 +1100

    build: drop old config file transition code from rpm specs
    
    Its been many years since this transition was done, good time
    now with pcp-5.0.0 to full this old shell code.  Also remove
    the Fedora crontab transition logic as thats completely moved
    over to systemd now.

Comment 3 Riccardo Schirone 2020-03-10 08:22:46 UTC
Please do not close this bug as this is not only Fedora specific, but it is used to describe the flaw.
For the Fedora tracker see bug 1811704.

Comment 4 Nathan Scott 2020-03-10 17:43:05 UTC
Ah, my mistake - apologies.  What information do you need from me?  (needinfo? set)

Comment 5 Nathan Scott 2020-03-16 04:11:21 UTC
AFAICT nothing more is needed from me at this time, clearing 'needinfo'.

Comment 7 Marco Benatto 2020-03-19 19:49:55 UTC
Upstream commit for this issue:
https://github.com/performancecopilot/pcp/commit/34c83f7ee46224fe410572f33c57a739f7bd044f

Comment 8 Marco Benatto 2020-03-20 13:36:49 UTC
There's an issue with pcp package, during pre installation phase the rpm copies some scripts from predetermined locations. Those scripts are further installed with permission to be executed as root user during post installation phase. An attacker may leverage this flaw by adding malicious code on certain scripts or manipulating those file paths, resulting in privilege escalation during package installation.

Comment 9 errata-xmlrpc 2020-09-29 19:24:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3869 https://access.redhat.com/errata/RHSA-2020:3869

Comment 10 Product Security DevOps Team 2020-09-29 22:00:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3695


Note You need to log in before you can comment on or make changes to this bug.