Red Hat Bugzilla – Bug 489355
CVE-2009-2737 roundup: privilege escalation in EditCSVAction
Last modified: 2009-08-11 06:26:20 EDT
It was found that any user able to create or edit queries in roundup is able to edit all queries (delete or modify other user's queries). This is due to EditCSVAction not having the same level of control over queries that SearchAction does (both in cgi/actions.py). This gives users admin-level power over other user's queries.
The upstream bug report is here: http://issues.roundup-tracker.org/issue2550521 and the Debian bug report is here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768
The recommended fix from upstream is to disable EditCSVAction altogether.
Created roundup tracking bugs for this issue
Affects: F10 [bug #489356]
Affects: F9 [bug #489357]
Created attachment 334557 [details]
patch from Debian's BTS to fix the issue
This patch disables EditCSVAction.
roundup-1.4.6-4.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
roundup-1.4.6-4.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before
1.2.1, 1.4 through 1.4.6, and possibly other versions does not
properly check permissions, which allows remote authenticated users
with edit or create privileges for a class to modify arbitrary items
within that class, as demonstrated by editing all queries, modifying
settings, and adding roles to users.