bugConcurrent Versions System - Bugs: bug #20534, Security: cvs client too keen to...

 
 

bug #20534: Security: cvs client too keen to change permissions

Submitted by:  Ed Avis <epaepa>
Submitted on:  Thu 19 Jul 2007 04:02:36 PM UTC  
 
Category: Bug ReportSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenRelease: 
Fixed Release: NoneFixed Feature Release: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 11 Dec 2007 05:56:55 PM UTC, comment #2:

This is still a problem with cvs-1.12.13 (contrary to the CVS FAQ which says that suid/sgid setting code has been removed).

Ed Avis <epaepa>
Thu 19 Jul 2007 04:03:55 PM UTC, comment #1:

% cvs --version

Concurrent Versions System (CVS) 1.11.22 (client/server)

Ed Avis <epaepa>
Thu 19 Jul 2007 04:02:36 PM UTC, original submission:

It seems that 'cvs update', when creating a new file in the working copy, copies permissions from the file in the repository to the local checked-out file. That is probably fine for the read, write and execute bits, but it's dangerous to copy the suid or sgid flags. This is a potential security hole - if an attacker can persuade you to connect to a CVS repository he controls and do a cvs update, then he can trick you into creating a suid binary owned by you.

To reproduce:

# First the user makes an ordinary CVS project and starts work.
% export CVSROOT=$HOME/cvsroot
% mkdir $CVSROOT
% cvs init
% mkdir ~/scratch
% cd ~/scratch
% cvs import -mmsg test a b
% cvs co test
% cd test
% echo '#!/bin/sh' >exe
% echo 'echo hello' >>exe
% chmod a+x exe
% cvs add exe
% cvs commit -mmsg exe

# Now let us suppose we are the attacker and we modify the
# permissions of exe,v in the repository. Although not shown
# here, the exploit also works if the repository is owned by
# some other user, as long as the checking-out user has
# permission to create cvs lock files.
% cd $CVSROOT/test
% chmod u+s exe,v

# Now back to the ordinary user, who for whatever reason decides
# to remove his working copy of exe and check it out fresh.
% cd ~/scratch/test
% rm exe
% cvs update exe
% ls -l exe

# Expected result: cvs was sensible enough not to copy the suid
# bit, so the permissions will be rwxr-xr-x or similar.
#
# Actual result: permissions shown as -rwsr-xr-x

I'd suggest that the only permission bit that should be set in the working copy by cvs is the user execute bit. The other permission bits are too dangerous to set without user intervention. Especially don't set the suid or sgid bits.

Ed Avis <epaepa>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by epaepa (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup