Bug 439687 (CVE-2008-1614) - CVE-2008-1614 mod_suphp: local privilege escalation through symlinks
Summary: CVE-2008-1614 mod_suphp: local privilege escalation through symlinks
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2008-1614
Product: Fedora
Classification: Fedora
Component: mod_suphp
Version: rawhide
Hardware: All
OS: Linux
low
urgent
Target Milestone: ---
Assignee: Andreas Thienemann
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-03-30 14:21 UTC by Felix Schwarz
Modified: 2008-04-02 15:09 UTC (History)
1 user (show)

Fixed In Version: 0.6.3-1.fc7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-04-01 21:32:36 UTC


Attachments (Terms of Use)
Fixes symlink checks (10.58 KB, patch)
2008-03-31 09:58 UTC, Wouter de Jong
no flags Details | Diff

Description Felix Schwarz 2008-03-30 14:21:26 UTC
Upstream found two local privilege escalation problems which include the use of
symlink. in mod_suphp 0.6.2. Fixes for these bugs are included in 0.6.3.
Upstream recommends an immediate update for all users.

Short upstream report: http://www.suphp.org/Home.html
Detailed report: http://article.gmane.org/gmane.comp.php.suphp.general/348

Comment 1 Felix Schwarz 2008-03-30 20:04:53 UTC
Unfortunately, I don't know any public version control system for mod_suphp.
This means it is quite hard to isolate the code fixing the described problems.
For Fedora we can just update to 0.6.3 but EPEL should get a backport.

Therefore I examined the releases 0.6.2 and 0.6.3 for changes ('diff --recursive
-u --exclude="aclocal*" --exclude="config*" --exclude="Makefile*"
--exclude=ChangeLog --exclude=INSTALL  suphp-0.6.2 suphp-0.6.3 > diff.patch').
The resulting diff is ~11 kB big but it seems to me that the only source code
changes since 0.6.2 were the mentioned fixes for the upstream problems. (I won't
attach the diff here as it is easy to recreate.)

Therefore I don't see a point backporting the fixes (and risk not fixing the
problems correctly).




Comment 2 Wouter de Jong 2008-03-31 09:57:25 UTC
https://ssl.marsching.biz/subversion/suphp/
However, there's no interface available AFAIK like trac or viewsvn.

I'd really like to see a fast fix for this problem, especially for Fedora 7 + 8.

You're right about 0.6.2 vs. 0.6.3 : the only change is this fix, and some 
automake fixes.

I'll attach the diff anyway.

Comment 3 Wouter de Jong 2008-03-31 09:58:13 UTC
Created attachment 299694 [details]
Fixes symlink checks

Comment 4 Fedora Update System 2008-03-31 18:55:02 UTC
mod_suphp-0.6.3-1.fc7 has been submitted as an update for Fedora 7

Comment 5 Fedora Update System 2008-03-31 18:55:27 UTC
mod_suphp-0.6.3-1.fc8 has been submitted as an update for Fedora 8

Comment 6 Fedora Update System 2008-04-01 21:32:34 UTC
mod_suphp-0.6.3-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2008-04-01 21:37:23 UTC
mod_suphp-0.6.3-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.