bugtraq - [Suspected Spam][oCERT-2009-019] Ganeti path sanitization errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20091217162631.GP24554@inversepath.com>
Date: Thu, 17 Dec 2009 16:26:31 +0000
From: Andrea Barisani <lcars@...rt.org>
To: oss-security@...ts.openwall.com, ocert-announce@...ts.ocert.org,
	bugtraq@...urityfocus.com
Subject: [Suspected Spam][oCERT-2009-019] Ganeti path sanitization errors

#2009-019 Ganeti path sanitization errors

Description:

Ganeti, an open source virtualisation manager, suffers from an input
validation bug that poses a security risk.

The vulnerability applies to the commands submitted, either locally via
gnt-* commands or remotely via the HTTP API, to the machine acting as a
cluster master. Validation for a file path argument is missing resulting
in arbitrary code execution, local exploitation applies to any user with
rights to execute ganeti commands while remote exploitation applies to
configured users authenticated over the ganeti RAPI.

While the local exploitation is a non-issue for the root user, which can
execute arbitrary commands in any case, it affects local non-root users
which are allowed to execute gnt-* commands via sudo or other suid
wrappers.

Affected version:

Ganeti >= 1.2.4 (local), >= 2.0.0 (remote)

Fixed version:

Ganeti >= 1.2.9, >= 2.0.5, >= 2.1.0~rc2

Credit: vulnerability report, PoC and patches received from Ganeti authors
Iustin Pop and Michael Hanselmann, Google Inc.

CVE: CVE-2009-4261

CVE: N/A

Timeline:

2009-12-07: vulnerability report received
2009-12-08: contacted affected vendors
2009-12-17: ganeti 1.2.9, 2.0.5, 2.1.0~rc2 released
2009-12-17: advisory published

References:
http://groups.google.com/group/ganeti/browse_thread/thread/cbce23d89103a8d2

Permalink:
http://www.ocert.org/advisories/ocert-2009-019.html

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | Open Source Computer Emergency Response Team

<lcars@...rt.org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"