Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:mrtg User: [email protected] Usertags: pu
[ Reason ] This PU solves #1144393, related to CVE-2026-72694. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files. [ Impact ] If the update isn't approved, we will have a security failure that can grant unauthorized access to sensitive files on desktops and servers. [ Tests ] Some manual tests were made. The changes work fine. These changes were provided by MRTG's upstream via a patch. [ Risks ] The risks are very low. A small part of the source code was changed and all changes were tested. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] The fix creates the PID file atomically with O_CREAT|O_EXCL, rejects symlinks, performs fchown() on the open file descriptor, and also prevents symlink-following when writing the PID later. [ Other info ] No more info.
diff -Nru mrtg-2.17.10/debian/changelog mrtg-2.17.10/debian/changelog --- mrtg-2.17.10/debian/changelog 2025-09-29 21:08:06.000000000 -0300 +++ mrtg-2.17.10/debian/changelog 2026-08-18 14:00:34.000000000 -0300 @@ -1,3 +1,11 @@ +mrtg (2.17.10-13+deb13u2) trixie; urgency=medium + + * debian/patches/110_fix-CVE-2026-72694: created to fix a symlink-following + chown of pid file in daemon mode. Thanks to Tobias Oetiker + <[email protected]>. This patch fixes CVE-2026-72694. (Closes: #1144393) + + -- Joao Eriberto Mota Filho <[email protected]> Tue, 18 Aug 2026 14:00:34 -0300 + mrtg (2.17.10-13+deb13u1) trixie; urgency=medium * debian/patches/010_enable-www-dir.patch: dropped because it is generating diff -Nru mrtg-2.17.10/debian/patches/110_fix-CVE-2026-72694.patch mrtg-2.17.10/debian/patches/110_fix-CVE-2026-72694.patch --- mrtg-2.17.10/debian/patches/110_fix-CVE-2026-72694.patch 1969-12-31 21:00:00.000000000 -0300 +++ mrtg-2.17.10/debian/patches/110_fix-CVE-2026-72694.patch 2026-08-18 14:00:34.000000000 -0300 @@ -0,0 +1,106 @@ +From 30e19216bfadc0148f347cb0a42fd5e2016e6269 Mon Sep 17 00:00:00 2001 +From: Tobias Oetiker <[email protected]> +Date: Tue, 30 Jun 2026 23:34:40 +0200 +Subject: [PATCH] Fix symlink-following chown of pid file in daemon mode (CWE-59) + . + When mrtg is started as root in daemon mode (--daemon --user), it + created the pid file and chown'ed it to the target user *before* + dropping privileges. Both create_pid()'s `-e`/`open(">...")` and the + subsequent `chown` follow symlinks, so a local attacker who can + pre-place a symlink at the pid path (e.g. a pid file in a writable + directory) could make root chown an arbitrary existing file to the + daemon user, or create a root-owned file at an attacker-chosen path. + . + Rather than reorder the privilege drop (which would break the common + case of a root-owned pid directory, where the unprivileged daemon + cannot create the file itself), keep creating the file while + privileged but do it safely: + . + - create_pid() refuses symlinks and creates the file with + O_WRONLY|O_CREAT|O_EXCL, closing the symlink-follow / TOCTOU window. + - It chowns the open filehandle (fchown) instead of the path, so the + ownership change cannot be redirected through a swapped-in symlink. + The caller no longer does a separate path-based chown. + - demonize_me()'s later pid write refuses symlinks too. +Origin: https://github.com/oetiker/mrtg/commit/30e1921 +Bug: https://github.com/oetiker/mrtg/pull/123 +Bug-Debian: https://bugs.debian.org/1144393 +Index: mrtg/bin/mrtg +=================================================================== +--- mrtg.orig/bin/mrtg ++++ mrtg/bin/mrtg +@@ -252,9 +252,11 @@ sub main { + + # Run as a daemon, specified on command line (required for FHS compliant daemon) + if (defined $opts{"daemon"}) { +- # Create a pidfile, then chown it so we can use it once we change user +- &create_pid($pidfile); +- chown $uid, $gid, $pidfile; ++ # Create the pidfile securely and, while still privileged, hand it to ++ # the user we are about to become so the daemon can update it later. ++ # create_pid refuses symlinks and chowns the open handle (not the path), ++ # so a hostile pid path cannot be used to chown an arbitrary file. ++ &create_pid($pidfile, $uid, $gid); + } + + ($(,$)) = ($gid,$gid) ; +Index: mrtg/lib/mrtg2/MRTG_lib.pm +=================================================================== +--- mrtg.orig/lib/mrtg2/MRTG_lib.pm ++++ mrtg/lib/mrtg2/MRTG_lib.pm +@@ -16,6 +16,7 @@ package MRTG_lib; + + require 5.005; + use strict; ++use Fcntl qw(O_WRONLY O_CREAT O_EXCL); + use vars qw($OS $SL $PS @EXPORT @ISA $VERSION %timestrpospattern); + + +@@ -1233,14 +1234,31 @@ sub expistr ($) { + return "$wday, $mday $month ".($year+1900)." $hour:$min:$sec GMT"; + } + +-sub create_pid ($) { +- my $pidfile = shift; ++sub create_pid ($;$$) { ++ my ($pidfile, $uid, $gid) = @_; + return if ($OS eq 'NT' ); ++ ++ # Security: refuse to operate on a symlink. When mrtg is started as root ++ # in daemon mode with a writable pid path, an attacker who pre-places a ++ # symlink here could otherwise make us create or chown an arbitrary file ++ # (CWE-59). A plain stat/-e on the path would follow the link, so check ++ # the link itself first. ++ if (-l $pidfile) { ++ warn "refusing to use pid file $pidfile: it is a symbolic link\n"; ++ return; ++ } + return if -e $pidfile; +- if ( open(PIDFILE,">$pidfile")) { +- close PIDFILE; ++ ++ # O_CREAT|O_EXCL creates the file atomically and fails if anything ++ # (including a symlink that was raced in after the check above) already ++ # exists at the path, closing the symlink-follow / TOCTOU window. ++ if ( sysopen(my $fh, $pidfile, O_WRONLY|O_CREAT|O_EXCL, 0644) ) { ++ # chown the open handle (fchown) rather than the path, so the ++ # ownership change cannot be redirected through a swapped-in symlink. ++ chown $uid, $gid, $fh if defined $uid and defined $gid; ++ close $fh; + } else { +- warn "cannot write to $pidfile: $!\n"; ++ warn "cannot create pid file $pidfile: $!\n"; + } + } + +@@ -1286,7 +1304,9 @@ sub demonize_me ($) { + } else { + if (defined $pidfile){ + $main::Cleanfile3 = $pidfile; +- if (open(PIDFILE,">$pidfile")) { ++ if (-l $pidfile) { ++ warn "refusing to write pid file $pidfile: it is a symbolic link\n"; ++ } elsif (open(PIDFILE,">$pidfile")) { + print PIDFILE "$$\n"; + close PIDFILE; + } else { diff -Nru mrtg-2.17.10/debian/patches/series mrtg-2.17.10/debian/patches/series --- mrtg-2.17.10/debian/patches/series 2025-09-29 21:08:06.000000000 -0300 +++ mrtg-2.17.10/debian/patches/series 2026-08-18 14:00:34.000000000 -0300 @@ -7,3 +7,4 @@ 080_fix-noHC-yes.patch 090_add-ubiquiti.patch 100_move-polish-to-utf8.patch +110_fix-CVE-2026-72694.patch
