Bug 605789 (CVE-2010-2192) - CVE-2010-2192 pmount: symlink attacks via lockfile files
Summary: CVE-2010-2192 pmount: symlink attacks via lockfile files
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-2192
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-18 18:57 UTC by Vincent Danen
Modified: 2019-09-29 12:37 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-06-18 19:03:16 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2010-06-18 18:57:46 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2192 to
the following vulnerability:

Name: CVE-2010-2192
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2192
Assigned: 20100607
Reference: CONFIRM: http://security.debian.org/pool/updates/main/p/pmount/pmount_0.9.18-2+lenny1.diff.gz
Reference: DEBIAN:DSA-2063
Reference: URL: http://www.debian.org/security/2010/dsa-2063

The make_lockdir_name function in policy.c in pmount 0.9.18 allow
local users to overwrite arbitrary files via a symlink attack on a
file in /var/lock/.


This bug was reported to Ubuntu [1].  The entire premise of this vulnerability requires /var/lock be world-writable (in Debian and Ubuntu /var/lock is world-writable with a sticky bit).  In Fedora and Red Hat Enterprise Linux, /var/lock is not world-writable (mode 0775, owned root:lock), so users would not be able to create arbitrary files or symlinks in /var/lock.

The patch [2] used to correct the flaw moves the pmount lock directory from /var/lock/pmount/ to /var/lib/pmount-locks/ which is presumably not a world-writable directory, but does not change anything else.

I am not convinced we need to adopt this patch, it looks pretty Debian/Ubuntu-specific.

[1] https://bugs.launchpad.net/ubuntu/+source/pmount/+bug/574809
[2] http://launchpadlibrarian.net/50504393/fix-pmount-var-lock-exploit-v2.diff

Comment 1 Vincent Danen 2010-06-18 19:03:16 UTC
I'm closing this as NOTABUG because the referenced patch does what we already (correctly) do.


Note You need to log in before you can comment on or make changes to this bug.