Bug 1811707 (CVE-2019-3696) - CVE-2019-3696 pcp: Local privilege escalation in pcp spec file through migrate_tempdirs
Summary: CVE-2019-3696 pcp: Local privilege escalation in pcp spec file through migrat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-3696
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1723598 1811710 1815528 1815529
Blocks: 1811711
TreeView+ depends on / blocked
 
Reported: 2020-03-09 15:26 UTC by Pedro Sampaio
Modified: 2020-09-29 22:00 UTC (History)
10 users (show)

Fixed In Version: pcp-5.0.0
Clone Of:
Environment:
Last Closed: 2020-09-29 22:00:03 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3869 0 None None None 2020-09-29 19:24:18 UTC

Description Pedro Sampaio 2020-03-09 15:26:31 UTC
A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the rpm packaging of pcp allows local user pcp to overwrite arbitrary files with arbitrary content.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1153921

Comment 1 Pedro Sampaio 2020-03-09 15:27:00 UTC
Created pcp tracking bugs for this issue:

Affects: fedora-all [bug 1811710]

Comment 2 Nathan Scott 2020-03-10 02:31:04 UTC
This issue was resolved some time ago by removing compatibility code in PCP v5 - all current Fedora versions are unaffected by the issue.

commit 34c83f7ee46224fe410572f33c57a739f7bd044f
Author: Nathan Scott <nathans>
Date:   Sun Oct 6 14:10:40 2019 +1100

    build: drop old config file transition code from rpm specs
    
    Its been many years since this transition was done, good time
    now with pcp-5.0.0 to full this old shell code.  Also remove
    the Fedora crontab transition logic as thats completely moved
    over to systemd now.

Comment 3 Riccardo Schirone 2020-03-10 08:23:35 UTC
Please do not close this bug as this is not only Fedora specific, but it is used to describe the flaw.
For the Fedora tracker see bug 1811710.

Comment 6 Marco Benatto 2020-03-20 13:59:04 UTC
Upstream commit for this issue:
https://github.com/performancecopilot/pcp/commit/34c83f7ee46224fe410572f33c57a739f7bd044f

Comment 7 Marco Benatto 2020-03-20 14:04:06 UTC
Currently pcp package during pre installation phase doesn't perform a proper file path check while saving existing configuration files, this allows an attacker to overwrite any existing files on this system, or create new ones by manipulating file paths. Local access and minimal privileges to perform basic file operations. Depending on how the attack is crafted this may result in high confidentiality, integrity and availability impact. A successful attack depends on user installing, reinstalling or upgrading the pcp package, thus User Interaction is set as required.

Comment 8 Nathan Scott 2020-03-24 00:34:39 UTC
(In reply to Marco Benatto from comment #7)
> by manipulating file paths. Local access and minimal privileges to perform
> basic file operations.
> [...]
> successful attack depends on user installing, reinstalling or upgrading the
> pcp package, thus User Interaction is set as required.

Note an attacker must also compromise the (system) account 'pcp' in order to
write to /var/log/pcp ($PCP_LOG_DIR), from whence config.sh is sourced.

Comment 9 errata-xmlrpc 2020-09-29 19:24:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3869 https://access.redhat.com/errata/RHSA-2020:3869

Comment 10 Product Security DevOps Team 2020-09-29 22:00:03 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3696


Note You need to log in before you can comment on or make changes to this bug.