Bug 856341 - (CVE-2012-4417) CVE-2012-4417 GlusterFS: insecure temporary file creation
CVE-2012-4417 GlusterFS: insecure temporary file creation
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20121112,reported=2...
: Security
: 852041 (view as bug list)
Depends On: 856345 856429 856677 875888 875889
Blocks: 856353
  Show dependency treegraph
 
Reported: 2012-09-11 16:08 EDT by Kurt Seifried
Modified: 2015-08-19 11:52 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-12-12 01:36:50 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2012-09-11 16:08:19 EDT
Jim Meyering (meyering@redhat.com) of Red Hat reports:

glusterfs writes to predictably-named files in /tmp using the PID and other 
non random or easily guessed information to create file names.

libglusterfs/src/statedump.c

gf_proc_dump_open (char *dump_dir, char *brickname)
{
        char path[PATH_MAX] = {0,};
        int  dump_fd = -1;

	snprintf (path, sizeof (path), "%s/%s.%d.dump", (dump_dir ?
                  dump_dir : "/tmp"), brickname, getpid());

...

gf_proc_dump_options_init ()
{
	int     ret = -1;
	FILE    *fp = NULL;
        char    buf[256];
        char    dumpbuf[GF_DUMP_MAX_BUF_LEN];
        char    *key = NULL, *value = NULL;
        char    *saveptr = NULL;
        char    dump_option_file[PATH_MAX];

	snprintf (dump_option_file, sizeof (dump_option_file),
                  "/tmp/glusterdump.%d.options", getpid ());
Comment 10 Murray McAllister 2012-10-14 18:31:47 EDT
Acknowledgements:

These issues were discovered by Kurt Seifried of Red Hat, and Jim Meyering.
Comment 14 Jan Lieskovsky 2012-11-12 13:36:57 EST
Created glusterfs tracking bugs for this issue

Affects: fedora-all [bug 875888]
Affects: epel-all [bug 875889]
Comment 15 errata-xmlrpc 2012-11-12 13:47:13 EST
This issue has been addressed in following products:

  Red Hat Storage 2.0
  Native Client for RHEL 6 for Red Hat Storage
  Native Client for RHEL 5 for Red Hat Storage

Via RHSA-2012:1456 https://rhn.redhat.com/errata/RHSA-2012-1456.html
Comment 16 JMW 2012-11-15 14:40:44 EST
Any word on an upstream fix?
Comment 17 Amar Tumballi 2012-11-15 22:29:09 EST
commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8 (http://review.gluster.org/4042)
and
commit 56d1f81949fde78615cd9fec048259d261f99c40 (http://review.gluster.org/4091)

are done upstream to handle it.
Comment 18 JMW 2012-11-16 07:30:05 EST
(In reply to comment #17)
> commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8
> (http://review.gluster.org/4042)
> and
> commit 56d1f81949fde78615cd9fec048259d261f99c40
> (http://review.gluster.org/4091)
> 
> are done upstream to handle it.

Thanks, Amar.
Comment 19 Kurt Seifried 2012-12-12 01:36:50 EST
This was partially addressed in http://rhn.redhat.com/errata/RHSA-2012-1456.html

Please see bug #886364 for additional information
Comment 20 JMW 2012-12-18 17:04:16 EST
(In reply to comment #17)
> commit 3d10587d9d6400c9141b1f278bb5e2027fa784b8
> (http://review.gluster.org/4042)
> and
> commit 56d1f81949fde78615cd9fec048259d261f99c40
> (http://review.gluster.org/4091)
> 
> are done upstream to handle it.

Amar - any chance of applying a patch to 3.2.x? This comes via this request:

https://security-tracker.debian.org/tracker/CVE-2012-4417

Note You need to log in before you can comment on or make changes to this bug.