http://bugzilla.opensuse.org/show_bug.cgi?id=1025716 Bug ID: 1025716 Summary: VUL-0: two symlink attacks fixed in dbus 1.10.16 [fdo #99828] Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: mikhail.kasimov@gmail.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/449 =============================================== D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems. The latest dbus release 1.10.16 fixes two symlink attacks in non-production-suitable configurations. I am treating these as bugs rather than practical vulnerabilities, and very much hope neither of these is going to affect any real users, but I'm reporting them to oss-security in case there's an attack vector that I've missed. Please reference fd.o #99828 or <https://bugs.freedesktop.org/show_bug.cgi?id=99828> in any notices that refer to these. I have already released 1.10.16 for the stable branch. For the development branch, 1.11.10 will have the same fixes. For the old stable branch 1.8.x, I'm going to apply the same fixes, but I am not planning to do a release just for this unless a vendor asks me to - they will be released next time there is a 1.8.x release for some other reason. Symlink attack in nonce-tcp transport ------------------------------------- Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=99828 Versions affected: dbus >= 1.4.10 Fixed in: dbus >= 1.11.10, 1.10.x >= 1.10.16 Exploitable by: local users on inadvisably configured Unix systems Impact: overwrite a file named "nonce" in an attacker-chosen directory with random contents known only to the victim Reporter: Simon McVittie, Collabora Ltd. The nonce-tcp transport writes a file to a randomly-named subdirectory of a system-wide temporary directory. It does not check whether the directory already exists (EEXIST from mkdir is ignored); so if the chosen directory is a symlink to an attacker-chosen directory, it would proceed to write a file named "nonce" to that directory. The file is created safely (O_EXCL, 0600 permissions, atomic-overwrite) and has random contents not chosen by the attacker. The reimplementation of this transport in GDBus does not have this bug. Mitigations include: * The nonce-tcp transport is only enabled if you ask for it when configuring dbus-daemon or a DBusServer. It was added as a workaround for Windows' lack of AF_UNIX sockets, and the only reason it is available on Unix is to be able to test it. Even on Windows, it should never be used on connections other than loopback (there is no confidentiality or integrity protection). * The directory has a random name with approximately 35 bits of entropy, so an attacker would have to either create a massive number of symlinks or be very lucky. * The attacker cannot choose the file contents. * The attacker cannot read the file contents. * Versions before 1.4.10 were unaffected by this bug because nonce-tcp didn't work on Unix at all. Workaround: do not use nonce-tcp. If you must use it, set the environment variable TMPDIR to a directory you control. Symlink attack in unit tests ---------------------------- Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=99828 Versions affected: >= 1.1.3 Fixed in: dbus >= 1.11.10, 1.10.x >= 1.10.16 Exploitable by: local users sharing a system with a dbus developer Impact: unlikely file overwrite Reporter: Simon McVittie, Collabora Ltd. One of the "embedded tests" accessed a system-wide temporary directory in an inadvisable manner. It is probably vulnerable to a symlink attack due to a time-of-check/time-of-use error. Mitigations: the "embedded tests" are not compiled in by default, are only intended to be used by dbus developers on trusted systems, and if they are enabled, ./configure specifically warns that they are insecure. The directory used is random with approximately 35 bits of entropy, so an attacker would have to either create a massive number of symlinks or be very lucky. Workaround: if you are testing older dbus versions, use a trusted machine, VM or container or set the environment variable TMPDIR to a directory you control. ---- Regards, S -- Simon McVittie Collabora Ltd. <https://www.collabora.com/> / Debian <https://www.debian.org/> =============================================== -- You are receiving this mail because: You are on the CC list for the bug.