ecryptfs team mailing list archive

[Launchpad Bug Tracker <732628@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package ecryptfs-utils - 83-0ubuntu3.2.10.10.1

---------------
ecryptfs-utils (83-0ubuntu3.2.10.10.1) maverick-security; urgency=low

  * SECURITY UPDATE: privilege escalation via mountpoint race conditions
    (LP: #732628)
    - src/utils/mount.ecryptfs_private.c: chdir into mountpoint before
      checking permissions. Patch thanks to Dan Rosenberg.
    - CVE-2011-1831
    - CVE-2011-1832
  * SECURITY UPDATE: race condition when checking source during mount
    (LP: #732628)
    - src/utils/mount.ecryptfs_private.c: use new ecryptfs_check_dev_ruid
      kernel option when mounting directory.
    - CVE-2011-1833
  * SECURITY UPDATE: mtab corruption via improper handling (LP: #732628)
    - src/utils/mount.ecryptfs_private.c: modify mtab via a temp file first
      and make sure it succeeds before replacing the real mtab. Patch
      thanks to Dan Rosenberg.
    - CVE-2011-1834
  * SECURITY UPDATE: key poisoning via insecure temp directory handling
    (LP: #732628)
    - src/utils/ecryptfs-setup-private: make sure we don't copy into a
      user controlled directory.
    - CVE-2011-1835
  * SECURITY UPDATE: arbitrary file overwrite via lock counter race
    condition (LP: #732628)
    - src/utils/mount.ecryptfs_private.c: verify permissions with a file
      descriptor, and don't follow symlinks.
    - CVE-2011-1837
 -- Marc Deslauriers <marc.deslauriers@xxxxxxxxxx>   Thu, 04 Aug 2011 10:41:53 -0400

** Changed in: ecryptfs-utils (Ubuntu Lucid)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of eCryptfs,
which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/732628

Title:
  TOCTOU in mount.ecryptfs_private

Status in eCryptfs - Enterprise Cryptographic Filesystem:
  Triaged
Status in “ecryptfs-utils” package in Ubuntu:
  Confirmed
Status in “ecryptfs-utils” source package in Lucid:
  Fix Released
Status in “ecryptfs-utils” source package in Maverick:
  Fix Released
Status in “ecryptfs-utils” source package in Natty:
  Fix Released
Status in “ecryptfs-utils” source package in Oneiric:
  Confirmed
Status in “ecryptfs-utils” package in Debian:
  New
Status in “ecryptfs-utils” package in Fedora:
  New

Bug description:
  check_ownerships() function doesn't work as it should because of a
  race condition.  Arguments of both mount() and umount() calls can be
  changed between the check and the usage.  This may lead to arbitrary
  mount point umounting or probably to gaining ability to try
  passphrases of otherpeople's ecryptfs storages.

  lock_counter() is also racy.  It (1) tries to check existance and
  ownership of the file before open(), (2) neither use stat() instead of
  lstat() nor O_NOFOLLOW, (3) is not protected against deletion of the
  lock file by the owner. The lock file should be probably created in
  root only writable directory before dropping EUID.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ecryptfs/+bug/732628/+subscriptions