Bug 920172 (CVE-2015-0296) - VUL-0: CVE-2015-0296: texlive: texlive rpm scriptlet allows unprivileged user to delete arbitrary files
Summary: VUL-0: CVE-2015-0296: texlive: texlive rpm scriptlet allows unprivileged use...
Status: RESOLVED INVALID
Alias: CVE-2015-0296
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Minor
Target Milestone: ---
Assignee: Dr. Werner Fink
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/114317/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-02 09:54 UTC by Marcus Meissner
Modified: 2015-03-02 10:16 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-03-02 09:54:50 UTC
via oss-sec


(I think we use a different method and do not try to clean home directories...)


A flaw was found in the pre-install script of texlive-base package derived from
texlive package. This flaw allows unprivileged user to remove arbitrary files 
on the system.

~ rpm -qa texlive-base --scripts
preinstall scriptlet (using /bin/sh):
rm -rf /usr/share/texlive/texmf-var
rm -rf /var/lib/texmf/*

# Following script in the preinstall scriplet allows attacker to remove arbitrary
files on the systems
for i in `find /home/*/.texlive* -type d -prune`; do
find $i -name *.fmt -type f | xargs rm -f > /dev/null 2>&1
done
...

Attacker can create a malicious file in his $HOME directory that would trigger
file removal and wait for the texlive-base package to be updated by administrator,
as when package will be updated it would run preinstall scriplet which would then
run malicious file in attacker $HOME directory as privileged user.

Reproducer and more information:

https://bugzilla.redhat.com/show_bug.cgi?id=1099238


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1197082
http://seclists.org/oss-sec/2015/q1/703
Comment 1 Marcus Meissner 2015-03-02 09:55:10 UTC
Werner, can you please check that we do not use /home cleaning?
Comment 2 Dr. Werner Fink 2015-03-02 10:16:01 UTC
IMHO we are not affected (beside this I would not use hardcoded /home/):

werner/texlive> find -name '*.spec' | xargs sed -rn '/^%pre([[:blank:]])|^%pre$/,/^%/p'

%pre

## POST
%post
%pre
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre
if ! %{_bindir}/getent group %{texgrp} > /dev/null 2>&1 ; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi


%post kpathsea-bin
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin
%pre kpathsea-bin
if test "$1" = 1 -a -z "$(%{_bindir}/getent group %{texgrp} 2>/dev/null)"; then
    %{_sbindir}/groupadd -r %{?texgid:-g %texgid} %{texgrp}
fi

%post kpathsea-bin