Bug 492517 - CVE-2007-3103 init.d xfs script chown race condition vulnerability
CVE-2007-3103 init.d xfs script chown race condition vulnerability
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: xorg-x11-xfs (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Adam Jackson
Fedora Extras Quality Assurance
: Security
Depends On: 242903
Blocks: F11Blocker/F11FinalBlocker
  Show dependency treegraph
 
Reported: 2009-03-27 04:03 EDT by Tomas Hoger
Modified: 2009-07-02 01:54 EDT (History)
1 user (show)

See Also:
Fixed In Version: 1.0.5-3.1.fc10
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 242903
Environment:
Last Closed: 2009-04-13 15:10:27 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2009-03-27 04:03:33 EDT
+++ This bug was initially created as a clone of Bug #242903 +++

From iDefense:

Local exploitation of a race condition vulnerability in init.d XFS (X Font
Server) script allows an attacker to elevate their privileges to root.

The XFS script is vulnerable to a race condition when it is started by init, or
by a system administrator. Specifically, it insecurely changes the file
permissions of a temporary file. This allows an attacker to make any file on the
system world writable.

Successful exploitation of this vulnerability results in an attacker gaining
root privileges on the affected system. However, in order to exploit this, it is
necessary for either the system to be rebooted, or for the administrator to
manually restart the XFS.


This was fixed in the XFS init script in Red Hat Enterprise Linux 4 and 5:
  https://rhn.redhat.com/errata/CVE-2007-3103.html

but it seems that the change never made it to Fedora.  Init script in Fedora still does mkdir/chown/chmod and not mkdir -m 1777 as is done in RHEL scripts.  Affects all current Fedora versions - F9 - F11/rawhide.  This should be fix, so we do not re-introduce the bug in RHEL6.
Comment 1 Adam Jackson 2009-04-13 15:10:27 EDT
Fixed in F-9 through rawhide, updates to follow shortly.
Comment 2 Fedora Update System 2009-07-02 01:53:29 EDT
xorg-x11-xfs-1.0.5-2.1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2009-07-02 01:54:02 EDT
xorg-x11-xfs-1.0.5-3.1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.