pxz: CVE-2015-1200: race condition in setting permissions

Debian Bug report logs - #775306
pxz: CVE-2015-1200: race condition in setting permissions

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Alexander Cherepanov <cherepan@mccme.ru>

To: submit@bugs.debian.org

Subject: pxz: race condition in setting permissions on output file

Date: Wed, 14 Jan 2015 00:40:04 +0300

Package: pxz
Version: 4.999.99~beta3+git659fc9b-2
Tags: security

pxz sets the mode of an output file to be the same as the one of an 
input file but does it only after compression is over. This leaves the 
output file with the wrong mode during all the time of the compression 
process.

Illustration:

$ truncate -s 1G foo

$ chmod 600 foo

$ pxz foo &
[1] 9240

$ ls -l foo.xz
-rw-r--r-- 1 user user 0 Jan 14 00:33 foo.xz

$ wait %
[1]+  Done                    pxz foo

$ ls -l foo.xz
-rw------- 1 user user 161976 Jan 14 00:33 foo.xz

The issue is similar to 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0296 .

-- 
Alexander Cherepanov

Message #10 received at 775306@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Alexander Cherepanov <cherepan@mccme.ru>, 775306@bugs.debian.org

Subject: Re: Bug#775306: pxz: race condition in setting permissions on output file

Date: Wed, 14 Jan 2015 05:25:02 +0100

[Message part 1 (text/plain, inline)]

control: severity -1 important

Hi Alexander,

On Dienstag, 13. Januar 2015, Alexander Cherepanov wrote:
> pxz sets the mode of an output file to be the same as the one of an
> input file but does it only after compression is over. This leaves the
> output file with the wrong mode during all the time of the compression
> process.

thanks for the bug report! Could you maybe come up with a patch? 


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 775306@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Alexander Cherepanov <cherepan@mccme.ru>, 775306@bugs.debian.org

Subject: Re: Bug#775306: pxz: race condition in setting permissions on output file

Date: Sun, 18 Jan 2015 21:45:21 +0100

Control: retitle -1 pxz: CVE-2015-1200: race condition in setting permissions

Hi

This has been assigned CVE-2015-1200 by MITRE.

Regards,
Salvatore

Message #24 received at 775306@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Holger Levsen <holger@layer-acht.org>

Cc: Alexander Cherepanov <cherepan@mccme.ru>, 775306@bugs.debian.org

Subject: Re: Bug#775306: pxz: race condition in setting permissions on output file

Date: Mon, 26 Jan 2015 19:59:42 +0100

[Message part 1 (text/plain, inline)]

On Wed, Jan 14, 2015 at 05:25:02AM +0100, Holger Levsen wrote:
> control: severity -1 important
> 
> Hi Alexander,
> 
> On Dienstag, 13. Januar 2015, Alexander Cherepanov wrote:
> > pxz sets the mode of an output file to be the same as the one of an
> > input file but does it only after compression is over. This leaves the
> > output file with the wrong mode during all the time of the compression
> > process.
> 
> thanks for the bug report! Could you maybe come up with a patch? 

Patch attached, can you take care of an upload and unblock with
the release team?

Cheers,
        Moritz

[CVE-2015-1200.patch (text/x-diff, attachment)]

Message #29 received at 775306@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: Moritz Mühlenhoff <jmm@inutil.org>

Cc: Alexander Cherepanov <cherepan@mccme.ru>, 775306@bugs.debian.org

Subject: Re: Bug#775306: pxz: race condition in setting permissions on output file

Date: Mon, 26 Jan 2015 20:26:00 +0100

[Message part 1 (text/plain, inline)]

Hi Moritz,

On Montag, 26. Januar 2015, Moritz Mühlenhoff wrote:
> Patch attached, can you take care of an upload and unblock with
> the release team?

thanks for the patch, can do!


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 775306-close@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@debian.org>

To: 775306-close@bugs.debian.org

Subject: Bug#775306: fixed in pxz 4.999.99~beta3+git659fc9b-3

Date: Tue, 27 Jan 2015 12:33:39 +0000

Source: pxz
Source-Version: 4.999.99~beta3+git659fc9b-3

We believe that the bug you reported is fixed in the latest version of
pxz, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 775306@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Holger Levsen <holger@debian.org> (supplier of updated pxz package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 27 Jan 2015 12:34:37 +0100
Source: pxz
Binary: pxz
Architecture: source amd64
Version: 4.999.99~beta3+git659fc9b-3
Distribution: unstable
Urgency: medium
Maintainer: Holger Levsen <holger@debian.org>
Changed-By: Holger Levsen <holger@debian.org>
Description:
 pxz        - parallel LZMA compressor using liblzma
Closes: 775306
Changes:
 pxz (4.999.99~beta3+git659fc9b-3) unstable; urgency=medium
 .
   * CVE-2015-1200: Fix race condition in setting permissions. Thanks to
     Moritz Mühlenhoff for the patch. (Closes: #775306)
Checksums-Sha1:
 468f4f4416df623a14a82614a6d176a4228f26e1 1936 pxz_4.999.99~beta3+git659fc9b-3.dsc
 30f7e3fc5f95269b8dcefbd031930af36c8ec57e 2772 pxz_4.999.99~beta3+git659fc9b-3.debian.tar.xz
 cd5dc7783750e89c996c494d4ca448094df4e1ff 9524 pxz_4.999.99~beta3+git659fc9b-3_amd64.deb
Checksums-Sha256:
 d8107b7e874fc4fab69b808c1c26765de56e8a7d29a2c076db613cb8afaea1b8 1936 pxz_4.999.99~beta3+git659fc9b-3.dsc
 af5152dc2d63da17f41640ce47638155d793f687fd557e4851aa7760fd376dd2 2772 pxz_4.999.99~beta3+git659fc9b-3.debian.tar.xz
 98b8588e9919ab8e9e425e44306683f553e3df122c7a66a77fd7c1daed15ddb9 9524 pxz_4.999.99~beta3+git659fc9b-3_amd64.deb
Files:
 282d9dc02fab1f422c1b2c71292d3e87 1936 misc optional pxz_4.999.99~beta3+git659fc9b-3.dsc
 0c5b5a634fffeb182feb7c3bc73ba6cb 2772 misc optional pxz_4.999.99~beta3+git659fc9b-3.debian.tar.xz
 c954ead13db388d76715732910e3b464 9524 misc optional pxz_4.999.99~beta3+git659fc9b-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIVAwUBVMeEdgkauFYGmqocAQpEPA//RK/j+4CfCIhtR4aZ5yfHeSxxlogEXcD5
WHAlhai7UB7S1sUTrOsoOZeVbYDwH/Pmx3wC6wiuT3OzmRMOhNGhtkKJtOt5KMw/
NYA9GIEMhKDIpmneXJlwRHrsvH4LNc9T2oSinB7FEPseUlduuFixUz0Q9FrS4muT
Fjm4LOrisa5FCHAFzl0YD37Zz1XTsjIk3fmhdQ+QT3o90QjpmrVmCvdJFKhkA9AF
dP0yV2C7I0EQAuxmrq2oUFWWbly7KFY0wyVCxOumPEujSTeaLpof4qeHDQWcFvAy
Q+v5LGqMXWhl6BDCgR/zd2wfgx1YMmVpbVXVtY83yKOdh42tdFajgWlvPxD2WNnV
wwKZ5+S3lagXvqlLtVozxLxxJN6fdlOO+TfBm566eJhA+mEEYYoJock0gbBdbAuw
MvvSsB0WU1WsmBV2shXcJJ345w53+NU9aCSVEYCZiD7R7eEyOB6WUpIzYAO/L8yY
/XkpgyYL5sTo0exk2BAr+RLXfny30nQpDmNcdj4apXF/JPg09xz4mNnvCB7iovXw
+IYBveweQ95goc+HbWu9N1hh7EJ1ssorU+x+YUbRiPxoFIjtyBgHzzlYEM60SZlU
yskDZ5YQk2KWiKjriIj2DfZ7JRBlm47W/pHzaF8hBFsW2xXfGTVZ9uLrFMB/ShIr
qibWz0V0+Z4=
=XpPH
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.