A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the rpm packaging of pcp allows local user pcp to overwrite arbitrary files with arbitrary content. References: https://bugzilla.suse.com/show_bug.cgi?id=1153921
Created pcp tracking bugs for this issue: Affects: fedora-all [bug 1811710]
This issue was resolved some time ago by removing compatibility code in PCP v5 - all current Fedora versions are unaffected by the issue. commit 34c83f7ee46224fe410572f33c57a739f7bd044f Author: Nathan Scott <nathans> Date: Sun Oct 6 14:10:40 2019 +1100 build: drop old config file transition code from rpm specs Its been many years since this transition was done, good time now with pcp-5.0.0 to full this old shell code. Also remove the Fedora crontab transition logic as thats completely moved over to systemd now.
Please do not close this bug as this is not only Fedora specific, but it is used to describe the flaw. For the Fedora tracker see bug 1811710.
Upstream commit for this issue: https://github.com/performancecopilot/pcp/commit/34c83f7ee46224fe410572f33c57a739f7bd044f
Currently pcp package during pre installation phase doesn't perform a proper file path check while saving existing configuration files, this allows an attacker to overwrite any existing files on this system, or create new ones by manipulating file paths. Local access and minimal privileges to perform basic file operations. Depending on how the attack is crafted this may result in high confidentiality, integrity and availability impact. A successful attack depends on user installing, reinstalling or upgrading the pcp package, thus User Interaction is set as required.
(In reply to Marco Benatto from comment #7) > by manipulating file paths. Local access and minimal privileges to perform > basic file operations. > [...] > successful attack depends on user installing, reinstalling or upgrading the > pcp package, thus User Interaction is set as required. Note an attacker must also compromise the (system) account 'pcp' in order to write to /var/log/pcp ($PCP_LOG_DIR), from whence config.sh is sourced.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3869 https://access.redhat.com/errata/RHSA-2020:3869
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3696