[oss-security] Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure

Type securityvulns
Reporter Securityvulns
Modified 2014-06-17T00:00:00



>> 39 if [ "${OS}" = "AIX" ]; then >> 40 TMPFILE=/tmp/lynis.$$

> We can make a CVE assignment corresponding to your disclosure of this > lynis.$$ issue on oss-security. Use CVE-2014-3982. A CVE for this most > likely won't (or shouldn't) have a > http://seclists.org/fulldisclosure/2014/Jun/21 reference unless the > original fulldisclosure author confirms the association.

We have heard from the original fulldisclosure author, and have permission to continue with the public CVE assignments here. The new status is that CVE-2014-3982 refers only to the above unsafe use of /tmp/lynis.$$ on AIX. It's quite possible that Linux distributions won't produce any security updates mapping to CVE-2014-3982.

A second CVE ID, CVE-2014-3986, refers to this separate vulnerability on non-AIX platforms (i.e., any uname except for AIX):

TMPFILE=`mktemp /tmp/lynis.XXXXXX` ... find ${I} -name "*.conf" -print >> ${TMPFILE}.unsorted

This apparently allows a straightforward symlink attack against the ${TMPFILE}.unsorted file. Credit for this discovery belongs to the same author as in the http://seclists.org/fulldisclosure/2014/Jun/21 post.

(There are two CVE IDs because the provenance of the first full public disclosure is not the same, and because the scope of CVE-2014-3982 had already been defined.)

CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTkn8OAAoJEKllVAevmvms5koH/RE9JjUTvar94cdrUd1XjlhJ B+lJS7H4oBrceS1aKg1kNtl8vHwlg7WsUzHKs4Ou7KIWHWTem3aMlz5p2C33mdM5 4fyf0Cci6zg8vgkW1sTeKJaXtuZg/JddZwPv71ElcgR0WYxale+Esqy+EpAO1jNM i9Tsx9+1cY7IUu2BMd3X8mDxugNNufUeIeOCls7QMAkWdiW38+Gbx11Wj7EUMK8m PAuNuBVEVSsiA5GDSxaJr6ENTixip3O5PvCjB28txfJq0Si0xiBl2DgglxQ+eGRm OpHhK3cFY2XPRAZeu303Lhdm6vPWKMUL2ZM4aotf6hxf4ss4RKrczA/QauagIas= =7RvE -----END PGP SIGNATURE-----