Bugzilla – Bug 828005
VUL-1: CVE-2013-2119: rubygem-passenger: incorrect temporary file usage
Last modified: 2019-07-24 13:43:53 UTC
is public, via rh bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=892813 Michael Scherer reported that the passenger ruby gem, when used in standalone mode, does not use temporary files in a secure manner. In the lib/phusion_passenger/standalone/main.rb's create_nginx_controller function, passenger creates an nginx configuration file insecurely and starts nginx with that configuration file: @temp_dir = "/tmp/passenger-standalone.#{$$}" @config_filename = "#{@temp_dir}/config" If a local attacker were able to create a temporary directory that passenger uses and supply a custom nginx configuration file they could start an nginx instance with their own configuration file. This could result in a denial of service condition for a legitimate service or, if passenger were executed as root (in order to have nginx listen on port 80, for instance), this could lead to a local root compromise.
Kurt Seifried 2013-05-29 14:46:57 EDT: This is now public and fixed in 3.0.21 and 4.0.5: http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ The source code fixes are available at: 4.0 series: https://github.com/FooBarWidget/passenger/commit/bfe619eec3a337b4868b9928dc273e70a4a96f37 3.0 series https://github.com/FooBarWidget/passenger/commit/0eaebb00f6b7327374069a7998064c68cc54e9f1
Hongli Lai 2013-05-29 15:58:56 EDT: For the 3.0 series, 0eaebb00 is not complete. You also need 56d9d39f.
Schubi, do we deploy it in that kind of way?
bugbot adjusting priority
Affected packages: SLE-11-SP2: rubygem-passenger SLE-11-SP2-PRODUCTS: rubygem-passenger
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2014-08-20. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/58405
released
SUSE-SU-2014:1272-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 828005 CVE References: CVE-2013-2119 Sources used: WebYaST 1.3 (src): rubygem-passenger-3.0.14-0.11.1 SUSE Studio Onsite 1.3 (src): rubygem-passenger-3.0.14-0.11.1 SUSE Lifecycle Management Server 1.3 (src): rubygem-passenger-3.0.14-0.11.1
Releasing for SLE-SLMS_1.3, SLE-STUDIOONSITE_1.3, SLE-WEBYAST_1.3
SUSE-SU-2016:0042-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 828005,919726,956281 CVE References: CVE-2013-2119,CVE-2013-4136,CVE-2015-7519 Sources used: SUSE Webyast 1.3 (src): rubygem-passenger-3.0.14-0.14.1 SUSE Studio Onsite 1.3 (src): rubygem-passenger-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3 (src): rubygem-passenger-3.0.14-0.14.1
.