Debian Bug report logs - #617938
/etc directories owned by non-root users allow privilege escalation attacks

Package: debian-policy; Maintainer for debian-policy is Debian Policy Editors <debian-policy@lists.debian.org>; Source for debian-policy is src:debian-policy (PTS, buildd, popcon).

Reported by: Vasiliy Kulikov <segoon@openwall.com>

Date: Sat, 12 Mar 2011 18:27:02 UTC

Severity: normal

Tags: wontfix

Done: Sean Whitton <spwhitton@spwhitton.name>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Jörg Sommer <joerg@alea.gnuu.de>:
Bug#617938; Package slrn. (Sat, 12 Mar 2011 18:27:05 GMT) (full text, mbox, link).


Acknowledgement sent to Vasiliy Kulikov <segoon@openwall.com>:
New Bug report received and forwarded. Copy sent to Jörg Sommer <joerg@alea.gnuu.de>. (Sat, 12 Mar 2011 18:27:05 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Vasiliy Kulikov <segoon@openwall.com>
To: submit@bugs.debian.org
Subject: wrong ownership of /var/log/news/ and /etc/news/
Date: Sat, 12 Mar 2011 21:25:58 +0300
Package: slrn
Version: 1.0.0~pre16-1
Severity: critical

Directories /var/log/news/ and /etc/news/ have weird ownership -
news:news. Some deb scripts use these directories as trusted and write
to files located there, e.g. like this (from slrnpull.postinst):

echo "$RET" > /etc/news/server

These directories must not be writable by non-root as it might
compromise root via specially crafted symlinks/hardlinks/etc. created by
user or group "news".

As these directories are not owned by a single package, but are created
by each package, all packages owning files in these directories might be
vulnerable:

$ apt-file search /etc/news/ | cut -d: -f1 | uniq
ifgate
inn
inn2
inn2-inews
innfeed
leafnode
slrn
slrnpull
uucpsend

If I should report this bug another way as it affects multiple packages,
please tell me how I should do it.

Reference: https://bugs.launchpad.net/ubuntu/+source/slrn/+bug/731547


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments




Information forwarded to debian-bugs-dist@lists.debian.org, Jörg Sommer <joerg@alea.gnuu.de>:
Bug#617938; Package slrn. (Sun, 19 Feb 2012 14:27:03 GMT) (full text, mbox, link).


Acknowledgement sent to manuk7 <manuk7@laposte.net>:
Extra info received and forwarded to list. Copy sent to Jörg Sommer <joerg@alea.gnuu.de>. (Sun, 19 Feb 2012 14:27:03 GMT) (full text, mbox, link).


Message #10 received at 617938@bugs.debian.org (full text, mbox, reply):

From: manuk7 <manuk7@laposte.net>
To: 617938@bugs.debian.org, 617938-submitter@bugs.debian.org
Subject: Re: wrong ownership of /var/log/news/ and /etc/news/
Date: Sun, 19 Feb 2012 15:22:26 +0100
Hello,

As mentioned in the Ubuntu bug report, this behavior seems in accordance
with the Debian Policy :
http://www.debian.org/doc/manuals/securing-debian-howto/ch12.en.html#s12.1.12.1

I'm not really convinced we may considered that as a bug, however it
should be reported to the Debian Policy (i don't know how) rather than
to any package.

I suggest to close this bug.




Message sent on to Vasiliy Kulikov <segoon@openwall.com>:
Bug#617938. (Sun, 19 Feb 2012 14:27:11 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Jörg Sommer <joerg@alea.gnuu.de>:
Bug#617938; Package slrn. (Wed, 04 Jul 2012 14:48:03 GMT) (full text, mbox, link).


Acknowledgement sent to Moritz Muehlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Jörg Sommer <joerg@alea.gnuu.de>. (Wed, 04 Jul 2012 14:48:04 GMT) (full text, mbox, link).


Message #18 received at 617938@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>
To: Vasiliy Kulikov <segoon@openwall.com>
Cc: 617938@bugs.debian.org, control@bugs.debian.org
Subject: Re: wrong ownership of /var/log/news/ and /etc/news/
Date: Wed, 4 Jul 2012 16:43:10 +0200
reassign 617938 debian-polic
severity 617938 normal
thanks

On Sat, Mar 12, 2011 at 09:25:58PM +0300, Vasiliy Kulikov wrote:
> Package: slrn
> Version: 1.0.0~pre16-1
> Severity: critical
> 
> Directories /var/log/news/ and /etc/news/ have weird ownership -
> news:news. Some deb scripts use these directories as trusted and write
> to files located there, e.g. like this (from slrnpull.postinst):
> 
> echo "$RET" > /etc/news/server
> 
> These directories must not be writable by non-root as it might
> compromise root via specially crafted symlinks/hardlinks/etc. created by
> user or group "news".
> 
> As these directories are not owned by a single package, but are created
> by each package, all packages owning files in these directories might be
> vulnerable:
> 
> $ apt-file search /etc/news/ | cut -d: -f1 | uniq
> ifgate
> inn
> inn2
> inn2-inews
> innfeed
> leafnode
> slrn
> slrnpull
> uucpsend
> 
> If I should report this bug another way as it affects multiple packages,
> please tell me how I should do it.

This is part of the Debian policy (11.7). I'm reassigning this to
debian-policy.

Cheers,
        Moritz




Bug reassigned from package 'slrn' to 'debian-polic'. Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Wed, 04 Jul 2012 14:48:08 GMT) (full text, mbox, link).


No longer marked as found in versions slrn/1.0.0~pre16-1. Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Wed, 04 Jul 2012 14:48:09 GMT) (full text, mbox, link).


Severity set to 'normal' from 'critical' Request was from Moritz Muehlenhoff <jmm@inutil.org> to control@bugs.debian.org. (Wed, 04 Jul 2012 14:48:09 GMT) (full text, mbox, link).


Bug reassigned from package 'debian-polic' to 'debian-policy'. Request was from Moritz Muehlenhoff <jmm@debian.org> to control@bugs.debian.org. (Wed, 04 Jul 2012 15:06:26 GMT) (full text, mbox, link).


Changed Bug title to '/etc directories owned by non-root users allow privilege escalation attacks' from 'wrong ownership of /var/log/news/ and /etc/news/' Request was from Russ Allbery <rra@debian.org> to control@bugs.debian.org. (Sun, 12 Aug 2012 18:30:08 GMT) (full text, mbox, link).


Reply sent to Sean Whitton <spwhitton@spwhitton.name>:
You have taken responsibility. (Fri, 11 Aug 2017 19:58:21 GMT) (full text, mbox, link).


Notification sent to Vasiliy Kulikov <segoon@openwall.com>:
Bug acknowledged by developer. (Fri, 11 Aug 2017 19:58:21 GMT) (full text, mbox, link).


Message #33 received at 617938-close@bugs.debian.org (full text, mbox, reply):

From: Sean Whitton <spwhitton@spwhitton.name>
To: 617938-close@bugs.debian.org, 688363-close@bugs.debian.org, 821363-close@bugs.debian.org, 192571-close@bugs.debian.org, 215549-close@bugs.debian.org, 263448-close@bugs.debian.org, 276160-close@bugs.debian.org, 408500-close@bugs.debian.org, 562863-close@bugs.debian.org, 587377-close@bugs.debian.org, 592564-close@bugs.debian.org, 656569-close@bugs.debian.org, 663917-close@bugs.debian.org, 683570-close@bugs.debian.org, 684673-close@bugs.debian.org, 697134-close@bugs.debian.org, 704233-close@bugs.debian.org, 727754-close@bugs.debian.org, 737559-close@bugs.debian.org, 795783-close@bugs.debian.org, 832654-close@bugs.debian.org, 71621-close@bugs.debian.org, 120418-close@bugs.debian.org, 267142-close@bugs.debian.org, 291631-close@bugs.debian.org, 338219-close@bugs.debian.org, 375502-close@bugs.debian.org, 391240-close@bugs.debian.org, 397939-close@bugs.debian.org, 400112-close@bugs.debian.org, 412668-close@bugs.debian.org, 431109-close@bugs.debian.org, 457364-close@bugs.debian.org, 458824-close@bugs.debian.org, 462996-close@bugs.debian.org, 465140-close@bugs.debian.org, 466550-close@bugs.debian.org, 485559-close@bugs.debian.org, 491055-close@bugs.debian.org, 492144-close@bugs.debian.org, 521810-close@bugs.debian.org, 525843-close@bugs.debian.org, 528453-close@bugs.debian.org, 535577-close@bugs.debian.org, 541872-close@bugs.debian.org, 543417-close@bugs.debian.org, 549910-close@bugs.debian.org, 554194-close@bugs.debian.org, 570141-close@bugs.debian.org, 572571-close@bugs.debian.org, 580135-close@bugs.debian.org, 593177-close@bugs.debian.org, 610298-close@bugs.debian.org, 633994-close@bugs.debian.org, 660705-close@bugs.debian.org, 642914-close@bugs.debian.org, 663762-close@bugs.debian.org, 671503-close@bugs.debian.org, 681289-close@bugs.debian.org, 685992-close@bugs.debian.org, 690495-close@bugs.debian.org, 694384-close@bugs.debian.org, 775318-close@bugs.debian.org, 798714-close@bugs.debian.org, 524461-close@bugs.debian.org, 555981-close@bugs.debian.org, 682282-close@bugs.debian.org, 686143-close@bugs.debian.org, 515837-close@bugs.debian.org, 779506-close@bugs.debian.org, 628174-close@bugs.debian.org, 661417-close@bugs.debian.org, 681562-close@bugs.debian.org, 490605-close@bugs.debian.org, 647570-close@bugs.debian.org
Subject: Closing inactive Policy bugs
Date: Fri, 11 Aug 2017 12:44:51 -0700
[Message part 1 (text/plain, inline)]
control: user debian-policy@packages.debian.org
control: usertag -1 +obsolete
control: tag -1 +wontfix

Russ Allbery and I did a round of in-person bug triage at DebConf17 and
we are closing this bug as inactive.

The reasons for closing fall into the following categories, from most
frequent to least frequent:

- issue is appropriate for Policy, there is a consensus on how to fix
  the problem, but preparing the patch is very time-consuming and no-one
  has volunteered to do it, and we do not judge the issue to be
  important enough to keep an open bug around;

- issue is appropriate for Policy but there does not yet exist a
  consensus on what should change, and no recent discussion.  A fresh
  discussion might allow us to reach consensus, and the messages in the
  old bug are unlikely to help very much; or

- issue is not appropriate for Policy.

If you feel this bug is still relevant and want to restart the
discussion, you can re-open the bug.  However, please consider instead
opening a new bug with a message that summarises and condenses the
previous discussion, updates the report for the current state of Debian,
and makes clear exactly what you think should change.

A lot of these old bugs have long side tangents and numerous messages,
and that old discussion is not necessarily helpful for figuring out what
Debian Policy should say today.

-- 
Sean Whitton
[signature.asc (application/pgp-signature, inline)]

Added tag(s) wontfix. Request was from Sean Whitton <spwhitton@spwhitton.name> to control@bugs.debian.org. (Fri, 11 Aug 2017 20:18:04 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 09 Sep 2017 07:35:52 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Jan 13 02:37:30 2018; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.