← Back to branch summary

~ubuntu-branches/ubuntu/quantal/ecryptfs-utils/quantal-proposed

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2011-1837.patch

  • Committer: Bazaar Package Importer
  • Author(s): Marc Deslauriers
  • Date: 2011-08-04 10:37:40 UTC
  • Revision ID: james.westby@ubuntu.com-20110804103740-k4bobcj7qpe94xuv
Tags: 89-0ubuntu2
https://launchpad.net/bugs/732628
https://launchpad.net/bugs/732628
https://launchpad.net/bugs/732628
https://launchpad.net/bugs/732628
https://launchpad.net/bugs/732628
https://launchpad.net/bugs/732628
* SECURITY UPDATE: privilege escalation via mountpoint race conditions
  (LP: #732628)
  - debian/patches/CVE-2011-1831,1832,1834.patch: chdir into mountpoint
    before checking permissions in src/utils/mount.ecryptfs_private.c.
  - CVE-2011-1831
  - CVE-2011-1832
* SECURITY UPDATE: race condition when checking source during mount
  (LP: #732628)
  - debian/patches/CVE-2011-1833.patch: use new ecryptfs_check_dev_ruid
    kernel option when mounting directory in
    src/utils/mount.ecryptfs_private.c.
  - CVE-2011-1833
* SECURITY UPDATE: mtab corruption via improper handling (LP: #732628)
  - debian/patches/CVE-2011-1831,1832,1834.patch: modify mtab via a temp
    file first and make sure it succeeds before replacing the real mtab
    in src/utils/mount.ecryptfs_private.c.
  - CVE-2011-1834
* SECURITY UPDATE: key poisoning via insecure temp directory handling
  (LP: #732628)
  - debian/patches/CVE-2011-1835.patch: make sure we don't copy into a
    user controlled directory in src/utils/ecryptfs-setup-private.
  - CVE-2011-1835
* SECURITY UPDATE: information disclosure via recovery mount in /tmp
  (LP: #732628)
  - debian/patches/CVE-2011-1836.patch: mount inside protected
    subdirectory in src/utils/ecryptfs-recover-private.
  - CVE-2011-1836
* SECURITY UPDATE: arbitrary file overwrite via lock counter race
  condition (LP: #732628)
  - debian/patches/CVE-2011-1837.patch: verify permissions with a file
    descriptor, and don't follow symlinks in
    src/utils/mount.ecryptfs_private.c.
  - CVE-2011-1837

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2011-1837.patch
 
1
Description: fix arbitrary file overwrite via lock counter race condition
 
2
Author: Marc Deslauriers <marc.deslauriers@canonical.com>
 
3
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ecryptfs-utils/+bug/732628
 
4
 
 
5
Index: ecryptfs-utils-89/src/utils/mount.ecryptfs_private.c
 
6
===================================================================
 
7
--- ecryptfs-utils-89.orig/src/utils/mount.ecryptfs_private.c   2011-07-28 13:58:58.829446203 -0400
 
8
+++ ecryptfs-utils-89/src/utils/mount.ecryptfs_private.c        2011-07-28 13:59:32.639446194 -0400
 
9
@@ -360,26 +360,27 @@
 
10
         * file, or it's not owned by the current user, append iterator
 
11
         * until we find a filename we can use.
 
12
         */
 
13
-       while (1) {
 
14
-               if (stat(f, &s)==0 && (!S_ISREG(s.st_mode) || s.st_uid!=uid)) {
 
15
+       while (i < 50) {
 
16
+               if (((fd = open(f, O_RDWR | O_CREAT | O_NOFOLLOW, 0600)) >= 0) &&
 
17
+                   (fstat(fd, &s)==0 && (S_ISREG(s.st_mode) && s.st_uid==uid))) {
 
18
+                       break;
 
19
+               } else {
 
20
+                       if (fd >= 0)
 
21
+                               close(fd);
 
22
                        free(f);
 
23
                        if (asprintf(&f, "%s/%s-%s-%s-%d", TMP, FSTYPE, u,
 
24
                            alias, i++) < 0) {
 
25
                                perror("asprintf");
 
26
                                return NULL;
 
27
                        }
 
28
-               } else {
 
29
-                       break;
 
30
                }
 
31
        }
 
32
-       /* open file for reading and writing */
 
33
-       if ((fd = open(f, O_RDWR)) < 0) {
 
34
-               /* Could not open it, so try to safely create it */
 
35
-               if ((fd = open(f, O_RDWR | O_CREAT | O_EXCL, 0600)) < 0) {
 
36
-                       perror("open");
 
37
-                       return NULL;
 
38
-               }
 
39
+
 
40
+       if (fd < 0) {
 
41
+               perror("open");
 
42
+               return NULL;
 
43
        }
 
44
+
 
45
        flock(fd, LOCK_EX);
 
46
        fh = fdopen(fd, "r+");
 
47
        if (fh == NULL) {