Red Hat Bugzilla – Bug 550346
CVE-2009-4411 acl: vulnerable to symlink attacks
Last modified: 2015-08-22 11:47:45 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4411 to the following vulnerability: Name: CVE-2009-4411 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4411 Assigned: 20091223 Reference: MLIST:[oss-security] 20091223 CVE request: acl 2.2.47 always follows symlinks Reference: URL: http://www.openwall.com/lists/oss-security/2009/12/23/2 Reference: CONFIRM: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499076 Reference: CONFIRM: http://git.savannah.gnu.org/cgit/acl.git/commit/?id=63451a0 Reference: CONFIRM: http://oss.sgi.com/bugzilla/show_bug.cgi?id=790 Reference: BID:37455 Reference: URL: http://www.securityfocus.com/bid/37455 Reference: SECUNIA:37907 Reference: URL: http://secunia.com/advisories/37907 Reference: XF:acl-setfacl-getfacl-symlink(55004) Reference: URL: http://xforce.iss.net/xforce/xfdb/55004 The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack.
This issue does not affect Red Hat Enterprise Linux 3, 4 or 5 because the -P and -L options work as documented. While investigating this issue, it was discovered that the setfacl -R option (whhen used without the -P or -L options) did behave contrary to what the manpage documentation specified by following symlinks in sub-directories when setting ACLs, in Red Hat Enterprise Linux 3 and 4. Due to this behaviour, changing how -R behaves would cause a regression of long-established behaviour in setfacl. The Red Hat Security Response Team have rated this issue as having low impact, and any potential fix has the risk of introducing a regression to relied upon (albeit incorrect) behaviour. A separate bug was created to track this issue for Red Hat Enterprise Linux 4. A fix may appear in future updates released as part of scheduled updates, if approved by product management (see bug #556880).