Bug#871321: tenshi: CVE-2017-11746: should create its PID file before dropping privileges

[Andreas Beckmann]

Followup-For: Bug #871321

Hi,

I'm rising the severity to serious because tenshi violates version
ordering constraints since this bug was fixed in wheezy-security:

 tenshi | 0.13-2| wheezy  | source, all
 tenshi | 0.13-2| stretch | source, all
 tenshi | 0.13-2| buster  | source, all
 tenshi | 0.13-2| sid | source, all
 tenshi | 0.13-2+deb7u1 | wheezy-security | source, all


Andreas

Bug#871321: tenshi: CVE-2017-11746: should create its PID file before dropping privileges

[Moritz Muehlenhoff]

On Mon, Aug 07, 2017 at 05:54:07PM +0200, Salvatore Bonaccorso wrote:
> Source: tenshi
> Version: 0.13-2
> Severity: normal
> Tags: upstream patch security
> Forwarded: https://github.com/inversepath/tenshi/issues/6
> 
> Hi,
> 
> the following vulnerability was published for tenshi.
> 
> CVE-2017-11746[0]:
> | Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a
> | non-root account, which might allow local users to kill arbitrary
> | processes by leveraging access to this non-root account for tenshi.pid
> | modification before a root script executes a "kill `cat
> | /pathname/tenshi.pid`" command.

Please provide a systemd unit, so that we can avoid using a PID file
altogether.

Cheers,
Moritz

Bug#871321: tenshi: CVE-2017-11746: should create its PID file before dropping privileges

[Salvatore Bonaccorso]

Source: tenshi
Version: 0.13-2
Severity: normal
Tags: upstream patch security
Forwarded: https://github.com/inversepath/tenshi/issues/6

Hi,

the following vulnerability was published for tenshi.

CVE-2017-11746[0]:
| Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a
| non-root account, which might allow local users to kill arbitrary
| processes by leveraging access to this non-root account for tenshi.pid
| modification before a root script executes a "kill `cat
| /pathname/tenshi.pid`" command.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11746
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11746
[1] https://github.com/inversepath/tenshi/issues/6
[2] 
https://github.com/inversepath/tenshi/commit/d0e7f28c13ffbd5888b31d6532c2faf78f10f176

Regards,
Salvatore