This bug was fixed in the package upstart - 1.13.2-0ubuntu9
---------------
upstart (1.13.2-0ubuntu9) vivid; urgency=medium
* debian/upstart-bin.upstart.cron.daily: Ensure the session uid matches that
of the session file itself to stop a user forcing the logrotation of
another users logs.
-- James Hunt <james.h...@ubuntu.com> Thu, 26 Feb 2015 14:35:41 +0000
** Changed in: upstart (Ubuntu)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to upstart in Ubuntu.
https://bugs.launchpad.net/bugs/1425685
Title:
Missing input sanitation in upstart logrotation cronjob
Status in upstart package in Ubuntu:
Fix Released
Bug description:
Ubuntu Vivid 1504 (development branch) installs an insecure upstart
logrotation script which will read user-supplied data from
/run/user/[uid]/upstart/sessions and pass then unsanitized to an env
command. As user run directory is user-writable, the user may inject
arbitrary commands into the logrotation script, which will be executed
during daily cron job execution around midnight with root privileges.
Problematic part of /etc/cron.daily/upstart:
for session in /run/user/*/upstart/sessions/*
do
env $(cat $session) /sbin/initctl emit rotate-logs >/dev/null 2>&1 || true
done
On a system with e.g. libpam-systemd installed, standard login on TTY
or via SSH will create the directory /run/user/[uid] writable to the
user. By preparing a suitable session file, user supplied code will be
run during the daily cron-jobs.
See [1] for more information.
# lsb_release -rd
Description: Ubuntu Vivid Vervet (development branch)
Release: 15.04
# apt-cache policy upstart-bin
upstart-bin:
Installed: 1.13.2-0ubuntu7
Candidate: 1.13.2-0ubuntu7
Version table:
*** 1.13.2-0ubuntu7 0
500 http://archive.ubuntu.com/ubuntu/ vivid/main i386 Packages
100 /var/lib/dpkg/status
[1]
http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
