Bug 790730 (CVE-2012-0860) - CVE-2012-0860 rhev: vds_installer insecure /tmp use
Summary: CVE-2012-0860 rhev: vds_installer insecure /tmp use
Alias: CVE-2012-0860
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 790736 790742 790747 850708
Blocks: 772458 850878
TreeView+ depends on / blocked
Reported: 2012-02-15 09:40 UTC by Petr Matousek
Modified: 2021-02-24 13:09 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-03-17 06:08:34 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1506 0 normal SHIPPED_LIVE Important: Red Hat Enterprise Virtualization Manager 3.1 2012-12-04 23:58:40 UTC
Red Hat Product Errata RHSA-2012:1508 0 normal SHIPPED_LIVE Important: rhev-3.1.0 vdsm security, bug fix, and enhancement update 2012-12-04 23:48:05 UTC

Description Petr Matousek 2012-02-15 09:40:45 UTC
When installing new host, RHEV-M connects to the host via ssh as root and copies vds_installer.py script into /tmp. vds_installer downloads deployUtil.py and vds_bootstrap.py via curl.

If we look into python docs [1], it clearly outlines the module search path. The first bullet says that:

"the directory containing the input script (or the current directory)."

is searched when the module to be imported is not built-in. In our case both the directory containing the input script and current directory is /tmp.

  [1] http://docs.python.org/tutorial/modules.html#the-module-search-path

To exploit the flaw you just need to create any of the imported modules in /tmp and it gets run as root upon host installation.

Other exploit might be to pre-create /tmp/deployUtil.py, wait for vor vds_installer to download it from RHEV-M and then change the content before it's imported/executed.

Either way, copying and running python scripts from /tmp is really bad idea. Use private directory in /tmp for scripts and logs.

vds_installer also creates log files with semi-random names which are prone to symlink attacks.

A local, unprivileged user on the host to be installed/addedd to RHEV-M could use this flaw to escalate their privileges.

Comment 4 Petr Matousek 2012-12-04 08:26:56 UTC

This issue does affect Red Hat Enterprise Virtualization 2 and 3.

Red Hat Enterprise Virtualization 2 is now in Production 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Virtualization Life Cycle: https://access.redhat.com/support/policy/updates/rhev/.

Comment 5 errata-xmlrpc 2012-12-04 18:53:41 UTC
This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2012:1508 https://rhn.redhat.com/errata/RHSA-2012-1508.html

Comment 6 errata-xmlrpc 2012-12-04 19:21:42 UTC
This issue has been addressed in following products:

  RHEV Manager version 3.x

Via RHSA-2012:1506 https://rhn.redhat.com/errata/RHSA-2012-1506.html

Comment 7 Alon Bar-Lev 2014-03-16 20:42:56 UTC

Any reason this bug is still opened?


Comment 8 Petr Matousek 2014-03-17 06:08:34 UTC
Hello, Alon.

(In reply to Alon Bar-Lev from comment #7)
> Any reason this bug is still opened?

No reason. Closing.


Note You need to log in before you can comment on or make changes to this bug.