XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
BID:37455
Info
XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
| Bugtraq ID: | 37455 |
| Class: | Design Error |
| CVE: |
CVE-2009-4411 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 23 2009 12:00AM |
| Updated: | Dec 24 2014 12:54AM |
| Credit: | Johan Ymerson |
| Vulnerable: |
XFS.org ACL 2.2.47 XFS.org ACL 2.2.46 SuSE SUSE Linux Enterprise 11 Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux |
| Not Vulnerable: |
XFS.org ACL 2.2.48 |
Discussion
XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
XFS ACL is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions, which may allow the attacker to gain elevated privileges or launch further attacks.
ACL 2.2.46 and 2.2.47 are vulnerable; other versions may also be affected.
XFS ACL is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions, which may allow the attacker to gain elevated privileges or launch further attacks.
ACL 2.2.46 and 2.2.47 are vulnerable; other versions may also be affected.
Exploit / POC
XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
Local attackers can use readily available tools to exploit this issue.
Local attackers can use readily available tools to exploit this issue.
Solution / Fix
XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for more information.
Slackware Linux 13.0 x86_64
Mandriva Linux Mandrake 2010.0 x86_64
Slackware Linux 12.1
Slackware Linux x86_64 -current
Slackware Linux 12.0
Mandriva Linux Mandrake 2009.1 x86_64
Slackware Linux -current
Mandriva Linux Mandrake 2009.0
Slackware Linux 13.0
MandrakeSoft Enterprise Server 5 x86_64
Slackware Linux 12.2
Mandriva Linux Mandrake 2009.0 x86_64
MandrakeSoft Enterprise Server 5
Slackware Linux 13.1 x86_64
Slackware Linux 11.0
Mandriva Linux Mandrake 2009.1
Slackware Linux 13.1
Mandriva Linux Mandrake 2010.0
XFS.org ACL 2.2.46
XFS.org ACL 2.2.47
Solution:
Updates are available. Please see the references for more information.
Slackware Linux 13.0 x86_64
-
Slackware acl-2.2.50-x86_64-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/acl-2.2.50-x86_64-1_slack13.0.txz
Mandriva Linux Mandrake 2010.0 x86_64
-
Mandriva acl-2.2.48-1.1mdv2010.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl-devel-2.2.48-1.1mdv2010.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl1-2.2.48-1.1mdv2010.0.x86_64.rpm
http://www.mandriva.com/en/download/
Slackware Linux 12.1
-
Slackware acl-2.2.50-i486-1_slack12.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ acl-2.2.50-i486-1_slack12.1.tgz
Slackware Linux x86_64 -current
-
Slackware acl-2.2.50-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ a/acl-2.2.50-x86_64-1.txz
Slackware Linux 12.0
-
Slackware acl-2.2.50-i486-1_slack12.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ acl-2.2.50-i486-1_slack12.0.tgz
Mandriva Linux Mandrake 2009.1 x86_64
-
Mandriva acl-2.2.47-5.1mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl-devel-2.2.47-5.1mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl1-2.2.47-5.1mdv2009.1.x86_64.rpm
http://www.mandriva.com/en/download/
Slackware Linux -current
-
Slackware acl-2.2.50-i486-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/ac l-2.2.50-i486-1.txz
Mandriva Linux Mandrake 2009.0
-
Mandriva acl-2.2.47-4.2mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl-devel-2.2.47-4.2mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl1-2.2.47-4.2mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/
Slackware Linux 13.0
-
Slackware acl-2.2.50-i486-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ acl-2.2.50-i486-1_slack13.0.txz
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva acl-2.2.47-4.2mdvmes5.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl-devel-2.2.47-4.2mdvmes5.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl1-2.2.47-4.2mdvmes5.x86_64.rpm
http://www.mandriva.com/en/download/
Slackware Linux 12.2
-
Slackware acl-2.2.50-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ acl-2.2.50-i486-1_slack12.2.tgz
Mandriva Linux Mandrake 2009.0 x86_64
-
Mandriva acl-2.2.47-4.2mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl-devel-2.2.47-4.2mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64acl1-2.2.47-4.2mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/
MandrakeSoft Enterprise Server 5
-
Mandriva acl-2.2.47-4.2mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl-devel-2.2.47-4.2mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl1-2.2.47-4.2mdvmes5.i586.rpm
http://www.mandriva.com/en/download/
Slackware Linux 13.1 x86_64
-
Slackware acl-2.2.50-x86_64-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/acl-2.2.50-x86_64-1_slack13.1.txz
Slackware Linux 11.0
-
Slackware acl-2.2.50-i486-1_slack11.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ acl-2.2.50-i486-1_slack11.0.tgz
Mandriva Linux Mandrake 2009.1
-
Mandriva acl-2.2.47-5.1mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl-devel-2.2.47-5.1mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl1-2.2.47-5.1mdv2009.1.i586.rpm
http://www.mandriva.com/en/download/
Slackware Linux 13.1
-
Slackware acl-2.2.50-i486-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ acl-2.2.50-i486-1_slack13.1.txz
Mandriva Linux Mandrake 2010.0
-
Mandriva acl-2.2.48-1.1mdv2010.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl-devel-2.2.48-1.1mdv2010.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libacl1-2.2.48-1.1mdv2010.0.i586.rpm
http://www.mandriva.com/en/download/
XFS.org ACL 2.2.46
-
XFS.org acl-2.2.49.src.tar.gz
http://download.savannah.gnu.org/releases-noredirect/acl/acl-2.2.49.sr c.tar.gz
XFS.org ACL 2.2.47
-
XFS.org acl-2.2.49.src.tar.gz
http://download.savannah.gnu.org/releases-noredirect/acl/acl-2.2.49.sr c.tar.gz
References
XFS ACL 'setfacl' and 'getfacl' Symbolic Link Handling Security Bypass Vulnerability
References:
References:
- #499076 - Physical walk no longer ignores all symlinks - Debian Bug report logs (Kevin Shanahan)
- ACL Homepage (Free Software Foundation)
- Bug 790 - getfacl 2.2.47 follows symlinks, even without -L (Johan Ymerson)
- CVE request: acl 2.2.47 always follows symlinks (Hanno Böck)
- Gentoo Bug 265425 - sys-apps/acl-2.2.47 has broken symlink handling (Radek Podgorny)
- Re: CVE request: acl 2.2.47 always follows symlinks (Brandon Philips)
- XFS.org Homepage (XFS.org)