Bug 439687 - (CVE-2008-1614) CVE-2008-1614 mod_suphp: local privilege escalation through symlinks
CVE-2008-1614 mod_suphp: local privilege escalation through symlinks
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: mod_suphp (Show other bugs)
rawhide
All Linux
low Severity urgent
: ---
: ---
Assigned To: Andreas Thienemann
Fedora Extras Quality Assurance
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-03-30 10:21 EDT by Felix Schwarz
Modified: 2008-04-02 11:09 EDT (History)
1 user (show)

See Also:
Fixed In Version: 0.6.3-1.fc7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-04-01 17:32:36 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fixes symlink checks (10.58 KB, patch)
2008-03-31 05:58 EDT, Wouter de Jong
no flags Details | Diff

  None (edit)
Description Felix Schwarz 2008-03-30 10:21:26 EDT
Upstream found two local privilege escalation problems which include the use of
symlink. in mod_suphp 0.6.2. Fixes for these bugs are included in 0.6.3.
Upstream recommends an immediate update for all users.

Short upstream report: http://www.suphp.org/Home.html
Detailed report: http://article.gmane.org/gmane.comp.php.suphp.general/348
Comment 1 Felix Schwarz 2008-03-30 16:04:53 EDT
Unfortunately, I don't know any public version control system for mod_suphp.
This means it is quite hard to isolate the code fixing the described problems.
For Fedora we can just update to 0.6.3 but EPEL should get a backport.

Therefore I examined the releases 0.6.2 and 0.6.3 for changes ('diff --recursive
-u --exclude="aclocal*" --exclude="config*" --exclude="Makefile*"
--exclude=ChangeLog --exclude=INSTALL  suphp-0.6.2 suphp-0.6.3 > diff.patch').
The resulting diff is ~11 kB big but it seems to me that the only source code
changes since 0.6.2 were the mentioned fixes for the upstream problems. (I won't
attach the diff here as it is easy to recreate.)

Therefore I don't see a point backporting the fixes (and risk not fixing the
problems correctly).


Comment 2 Wouter de Jong 2008-03-31 05:57:25 EDT
https://ssl.marsching.biz/subversion/suphp/
However, there's no interface available AFAIK like trac or viewsvn.

I'd really like to see a fast fix for this problem, especially for Fedora 7 + 8.

You're right about 0.6.2 vs. 0.6.3 : the only change is this fix, and some 
automake fixes.

I'll attach the diff anyway.
Comment 3 Wouter de Jong 2008-03-31 05:58:13 EDT
Created attachment 299694 [details]
Fixes symlink checks
Comment 4 Fedora Update System 2008-03-31 14:55:02 EDT
mod_suphp-0.6.3-1.fc7 has been submitted as an update for Fedora 7
Comment 5 Fedora Update System 2008-03-31 14:55:27 EDT
mod_suphp-0.6.3-1.fc8 has been submitted as an update for Fedora 8
Comment 6 Fedora Update System 2008-04-01 17:32:34 EDT
mod_suphp-0.6.3-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2008-04-01 17:37:23 EDT
mod_suphp-0.6.3-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.