Hi again
Here is the working patch (attached).
Hope it helps for later versions too.
// Ola
On Tue, Aug 2, 2016 at 12:15 AM, Ola Lundqvist <[email protected]> wrote:
> Hi again
>
> I just realize that we need to change back the umask after the file is
> created. I'll update the patch tomorrow and send one that I know works.
>
> // Ola
>
> On Tue, Aug 2, 2016 at 12:13 AM, Ola Lundqvist <[email protected]> wrote:
>
>> Hi all
>>
>> I have prepared a preliminary patch for wheezy. I have not yet been able
>> to test it fully (it is building right now). It looks like attached. You
>> may need to modify it for later versions.
>>
>> Please comment. The principles should be ok even if I may have made some
>> stupid copy+paste mistake. It worked fine in a little test program I made.
>>
>> Hope this helps
>>
>> // Ola
>>
>> On Mon, Aug 1, 2016 at 5:53 AM, Chris Lamb <[email protected]> wrote:
>>
>>> > 2) How do you plan to handle the "upgrade case" that is will you try to
>>> > change the permission on already created history file or will you just
>>> > handle the creation case?
>>>
>>> For redis, what I did was set and then unset the umask (for creation) and
>>> chmod(2) the file afterwards to "upgrade" existing ones.
>>>
>>> I don't recommend a postinst approach (ie. chmod 0600 /home/*/.filename)
>>> for
>>> various reasons.
>>>
>>>
>>> Regards,
>>>
>>> --
>>> ,''`.
>>> : :' : Chris Lamb
>>> `. `'` [email protected] / chris-lamb.co.uk
>>> `-
>>>
>>
>>
>>
>> --
>> --- Inguza Technology AB --- MSc in Information Technology ----
>> / [email protected] Folkebogatan 26 \
>> | [email protected] 654 68 KARLSTAD |
>> | http://inguza.com/ Mobile: +46 (0)70-332 1551 |
>> \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /
>> ---------------------------------------------------------------
>>
>>
>
>
> --
> --- Inguza Technology AB --- MSc in Information Technology ----
> / [email protected] Folkebogatan 26 \
> | [email protected] 654 68 KARLSTAD |
> | http://inguza.com/ Mobile: +46 (0)70-332 1551 |
> \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /
> ---------------------------------------------------------------
>
>
--
--- Inguza Technology AB --- MSc in Information Technology ----
/ [email protected] Folkebogatan 26 \
| [email protected] 654 68 KARLSTAD |
| http://inguza.com/ Mobile: +46 (0)70-332 1551 |
\ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /
---------------------------------------------------------------
Description: World readable dbshell log file
This correction make sure the ~/.dbshell log file is not world readable.
.
mongodb (1:2.0.6-1+deb7u1) wheezy-security; urgency=high
.
* Non-maintainer upload by the Long Term Security Team.
* Make sure dbshell log file is not readable by others
CVE-2016-6494 (Closes: #832908).
Author: Ola Lundqvist <[email protected]>
Origin: other
Bug: https://jira.mongodb.org/browse/SERVER-25335
Bug-Debian: https://bugs.debian.org/832908
Forwarded: no
Reviewed-By: Ola Lundqvist <[email protected]>
Last-Update: 2016-08-01
Index: mongodb-2.0.6/third_party/linenoise/linenoise.cpp
===================================================================
--- mongodb-2.0.6.orig/third_party/linenoise/linenoise.cpp 2016-08-01 22:10:07.318825853 +0000
+++ mongodb-2.0.6/third_party/linenoise/linenoise.cpp 2016-08-01 22:19:52.706824724 +0000
@@ -104,11 +104,13 @@
#include <termios.h>
#include <unistd.h>
+#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>
+#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <unistd.h>
@@ -799,6 +801,9 @@
/* Save the history in the specified file. On success 0 is returned
* otherwise -1 is returned. */
int linenoiseHistorySave(const char *filename) {
+ mode_t prev_mask = umask(0022);
+ // Make sure this file is not readable by others
+ umask(prev_mask | S_IROTH | S_IWOTH | S_IXOTH);
FILE *fp = fopen(filename,"w");
int j;
@@ -808,6 +813,7 @@
fprintf(fp,"%s\n",history[j]);
}
fclose(fp);
+ umask(prev_mask);
return 0;
}
@@ -817,6 +823,16 @@
* If the file exists and the operation succeeded 0 is returned, otherwise
* on error -1 is returned. */
int linenoiseHistoryLoad(const char *filename) {
+ struct stat fileStat;
+ if (stat(filename,&fileStat) < 0) return -1;
+ if (fileStat.st_mode & S_IROTH ||
+ fileStat.st_mode & S_IWOTH ||
+ fileStat.st_mode & S_IXOTH) {
+ // If the file is world readable, writeable or executable
+ // make sure it is not but keep all other permissions.
+ chmod(filename, fileStat.st_mode & 0777770);
+ }
+
FILE *fp = fopen(filename,"r");
char buf[LINENOISE_MAX_LINE];
