[Fedora-i18n-bugs] [Bug 1108612] New: CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612

            Bug ID: 1108612
           Summary: CVE-2014-3980 libfep: local privilege escalation via
                    UNIX domain sockets in the abstract namespace
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: vkaigoro(a)redhat.com
                CC: dueno(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org



It was discovered that libfep uses UNIX domain sockets in the abstract 
namespace in an insecure way.  As a result, unprivileged local users 
were able to inject commands into running fep sessions of other users.

The upstream fix simply removes abstract namespace support, using a 
restricted directory to host the UNIX domain socket instead:

https://github.com/ueno/libfep/commit/293d9d3f

Abstract namespace support was introduced in this commit:

https://github.com/ueno/libfep/commit/5a170323

This means that versions from 0.0.5 to 0.0.9 (inclusive) are vulnerable, 
and 0.1.0 has the fix.

External references:

 http://www.openwall.com/lists/oss-security/2014/06/05/16
 http://www.securityfocus.com/bid/67903

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=ZaCbDdpjD1&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612

Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1108616



--- Comment #1 from Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; ---

Created libfep tracking bugs for this issue:

Affects: fedora-all [bug 1108616]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1108616
[Bug 1108616] CVE-2014-3980 libfep: local privilege escalation via UNIX
domain sockets in the abstract namespace [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=Pnx0hRA74J&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612
Bug 1108612 depends on bug 1108616, which changed state.

Bug 1108616 Summary: CVE-2014-3980 libfep: local privilege escalation via UNIX domain
sockets in the abstract namespace [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1108616

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=hurwsSNkha&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612



--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
libfep-0.1.0-1.fc19 has been pushed to the Fedora 19 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=yAOwSKCRjh&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612



--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
libfep-0.1.0-1.fc20 has been pushed to the Fedora 20 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=dxKKkY4H2D&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|0.1.0                       |libfep 0.1.0



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=Wra21GoIFt&a=cc_unsubscribe

[Fedora-i18n-bugs] [Bug 1108612] CVE-2014-3980 libfep: local privilege escalation via UNIX domain sockets in the abstract namespace

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1108612

Ján Rusnačko <jrusnack(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2014 |impact=moderate,public=2014
                   |0605,reported=20140612,sour |0605,reported=20140612,sour
                   |ce=cvecan,cvss2=3.2/AV:L/AC |ce=cve,cvss2=3.2/AV:L/AC:L/
                   |:L/Au:S/C:P/I:P/A:N,fedora- |Au:S/C:P/I:P/A:N,fedora-all
                   |all/libfep=affected         |/libfep=affected



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=xtNHEx25Ju&a=cc_unsubscribe