Bug 885003 (CVE-2012-0786) - VUL-0: CVE-2012-0786: augeas: transform_save can overwrite files via .augnew symlink
Summary: VUL-0: CVE-2012-0786: augeas: transform_save can overwrite files via .augnew ...
Status: RESOLVED FIXED
Alias: CVE-2012-0786
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-07-16
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:running:58161:moderate maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-06-30 14:51 UTC by Marcus Meissner
Modified: 2014-09-01 10:00 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2014-06-30 14:51:25 UTC
public, via cve db

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0786

The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.

https://github.com/hercules-team/augeas/commit/16387744

fixes:
https://github.com/hercules-team/augeas/commit/16387744
https://github.com/hercules-team/augeas/commit/1a66739c
https://github.com/hercules-team/augeas/commit/051c73a9

please see bug 853044 for a follow up fix too.
Comment 1 Swamp Workflow Management 2014-06-30 22:00:12 UTC
bugbot adjusting priority
Comment 2 Tomáš Chvátal 2014-07-01 09:08:25 UTC
Submitted in sr#40245 to SLE11SP3.

The test patches didn't apply and it would be PITA to backport them so I made it continue with failed testsuite and explained which tests are expected to fail for further reference.
Comment 4 SMASH SMASH 2014-07-02 09:29:17 UTC
Affected packages:

SLE-11-SP3: augeas
Comment 6 Swamp Workflow Management 2014-07-02 14:13:17 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2014-07-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58170
Comment 7 SMASH SMASH 2014-07-02 14:15:19 UTC
Affected packages:

SLE-11-SP3: augeas
Comment 8 Tomáš Chvátal 2014-07-22 09:01:49 UTC
Seems the upstream patches broke storage completely as reported by jmatejka.

Going to investigate deper.
Comment 9 Tomáš Chvátal 2014-07-22 11:55:44 UTC
Updated package submitted again. This time even bit fancier and I fixed all the tests just to be sure :)
Comment 14 Swamp Workflow Management 2014-08-13 21:04:58 UTC
SUSE-SU-2014:1017-1: An update that solves two vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 853044,871323,876044,885003
CVE References: CVE-2012-0786,CVE-2013-6412
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    augeas-0.9.0-3.15.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    augeas-0.9.0-3.15.1
SUSE Linux Enterprise Server 11 SP3 (src):    augeas-0.9.0-3.15.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    augeas-0.9.0-3.15.1
Comment 15 Marcus Meissner 2014-09-01 10:00:01 UTC
was released