Bugzilla – Bug 853044
VUL-0: CVE-2013-6412: augeas: incorrect permissions set on newly created files
Last modified: 2014-09-01 14:04:15 UTC
CVE-2013-6412 Augeas upstream commit 051c73a9: https://github.com/hercules-team/augeas/commit/051c73a9 introduced a flaw in the way Augeas sets permissions on newly created files. The above commit aims to address a regression introduced in the fix for CVE-2012-0786 (see bug 772257 comment 39), which introduced a use of mkstemp() to create new files. mkstemp() always sets 0600 file permissions regardless of the current umask setting. Commit 051c73a9 attempts to fix file permissions based on umask setting, but it does not correctly handle certain umask values, causing Augeas to make newly created files world writable. A local user could possibly use this flaw to modify configuration files created by an application using Augeas. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6412 https://bugzilla.redhat.com/show_bug.cgi?id=1034261
Michal, are we affected on SLE?
bugbot adjusting priority
Affected packages: SLE-11-SP3: augeas
Submitted with bnc#885003.
SUSE-SU-2014:1017-1: An update that solves two vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 853044,871323,876044,885003 CVE References: CVE-2012-0786,CVE-2013-6412 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): augeas-0.9.0-3.15.1 SUSE Linux Enterprise Server 11 SP3 for VMware (src): augeas-0.9.0-3.15.1 SUSE Linux Enterprise Server 11 SP3 (src): augeas-0.9.0-3.15.1 SUSE Linux Enterprise Desktop 11 SP3 (src): augeas-0.9.0-3.15.1
released