Acknowledgement sent
to Raphael Geissert <geissert@debian.org>:
New Bug report received and forwarded. Copy sent to Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>.
(Tue, 28 Sep 2010 04:24:07 GMT) (full text, mbox, link).
Package: ardour
Version: 1:2.8.11-1
Severity: grave
Tags: security
User: team@security.debian.org
Usertags: ldpath
Hello,
During a review of the Debian archive, I've found your package to
contain a script that can be abused by an attacker to execute arbitrary
code.
The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.
Vulnerable code follows:
/usr/bin/ardour2 line 5:
export LD_LIBRARY_PATH=/usr/lib/ardour2:$LD_LIBRARY_PATH
When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.
This vulnerability has been assigned the CVE id CVE-2010-3349. Please make sure
you mention it when forwarding this report to upstream and when fixing
this bug (everywhere: upstream and here at Debian.)
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3349
[1] http://security-tracker.debian.org/tracker/CVE-2010-3349
Sincerely,
Raphael Geissert
Acknowledgement sent
to Adrian Knoth <adi@drcomp.erfurt.thur.de>:
Extra info received and forwarded to list. Copy sent to Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>.
(Tue, 28 Sep 2010 11:51:03 GMT) (full text, mbox, link).
On Tue, Sep 28, 2010 at 04:21:09AM +0000, Raphael Geissert wrote:
Hi!
> During a review of the Debian archive, I've found your package to
> contain a script that can be abused by an attacker to execute arbitrary
> code.
> /usr/bin/ardour2 line 5:
> export LD_LIBRARY_PATH=/usr/lib/ardour2:$LD_LIBRARY_PATH
Can you elaborate on this or give a link with a more detailed
explanation?
LD_LIBRARY_PATH is a well-known feature, and every binary can, by
design, be run with libraries from different paths, including CWD, if
the user sets LD_LIBRARY_PATH appropriately.
I don't see how importing LD_LIBRARY_PATH in a script is any different
from running an arbitrary binary (also with LD_LIBRARY_PATH being set).
According to your logic, every dynamically linked binary would be
vulnerable.
In other words, I don't see a security issue at all. If the user
deliberately sets LD_LIBRARY_PATH, it's his ultimate responsibility.
LD_LIBRARY_PATH is just a more cumbersome way of running completely
different code.
I might miss something, but unless you rely on RPATH, you could file
this kind of bug against almost every package. And given that
LD_LIBRARY_PATH is a valid use case, we somehow need to pass it to the
binary. I don't see that manually filtering LD_LIBRARY_PATH is any good.
The user sets it, the user gets it.
Please feel free to correct my understanding of the "issue" at hand.
Cheerio
--
mail: adi@thur.de http://adi.thur.de PGP/GPG: key via keyserver
Acknowledgement sent
to Adrian Knoth <adi@drcomp.erfurt.thur.de>:
Extra info received and forwarded to list. Copy sent to Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>.
(Tue, 28 Sep 2010 12:27:12 GMT) (full text, mbox, link).
On 09/28/10 13:48, Adrian Knoth wrote:
Hi!
> I might miss something
Ok, it's the trailing colon that might cause problems if LD_LIBRARY_PATH
is unset and CWD contains a malicious library.
I'm going to fix this.
Sorry for bothering you in the first place.
Bug reassigned from package 'ardour' to 'src:ardour'.
Request was from Adrian Knoth <adi@drcomp.erfurt.thur.de>
to control@bugs.debian.org.
(Tue, 28 Sep 2010 14:09:06 GMT) (full text, mbox, link).
Bug No longer marked as found in versions ardour/1:2.8.11-1.
Request was from Adrian Knoth <adi@drcomp.erfurt.thur.de>
to control@bugs.debian.org.
(Tue, 28 Sep 2010 14:09:07 GMT) (full text, mbox, link).
Forcibly Merged 598282598283.
Request was from Adrian Knoth <adi@drcomp.erfurt.thur.de>
to control@bugs.debian.org.
(Tue, 28 Sep 2010 14:09:10 GMT) (full text, mbox, link).
Added tag(s) pending.
Request was from Adrian Knoth <adi@drcomp.erfurt.thur.de>
to control@bugs.debian.org.
(Tue, 28 Sep 2010 19:30:05 GMT) (full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Sun, 07 Nov 2010 07:36:28 GMT) (full text, mbox, link).
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.