[CVE-2004-0564] attackers can overwrite any files when run with setuid root

Debian Bug report logs - #343264
[CVE-2004-0564] attackers can overwrite any files when run with setuid root

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: FX <gentoo@sbcglobal.net>

To: submit@bugs.debian.org

Subject: [CVE-2004-0564] attackers can overwrite any files when run with setuid root

Date: Tue, 13 Dec 2005 19:30:33 -0600

package: pppoe
severity: grave
tags: security

Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet 
driver from Roaring Penguin. When the program is running setuid root, an 
attacker could overwrite any file on the file system.

CVE-2004-0564:  Roaring Penguin pppoe (rp-ppoe), if installed or 
configured to run setuid root contrary to its design, allows local users 
to overwrite arbitrary files.
NOTE: the developer has publicly disputed the claim that this is a 
vulnerability because pppoe "is NOT designed to run setuid-root." 
Therefore this identifier applies *only* to those configurations and 
installations under which pppoe is run setuid root despite the 
developer's warnings.

This was fixed in Redhat a month ago despite their default configuration 
not using suid. See [FLSA-2005:152794]

In Debian Sarge, both /usr/sbin/pppd and /usr/sbin/pppoe files are 
"-rwsr-xr-- root dip".

Message #10 received at 343264-done@bugs.debian.org (full text, mbox, reply):

From: Christian Hudon <chrish@pianocktail.org>

To: FX <gentoo@sbcglobal.net>, 343264-done@bugs.debian.org

Subject: Re: Bug#343264: [CVE-2004-0564] attackers can overwrite any files when run with setuid root

Date: Tue, 13 Dec 2005 20:59:35 -0500

FX wrote:
> Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet 
> driver from Roaring Penguin. When the program is running setuid root, 
> an attacker could overwrite any file on the file system.
This is rather old and was fixed more than a year ago in Debian:

Date: Wed, 29 Sep 2004 22:08:20 -0400
Source: rp-pppoe
Binary: pppoe
Architecture: source i386
Version: 3.5-4
Distribution: unstable
Urgency: high
Maintainer: Christian Hudon <chrish@debian.org>
Changed-By: Christian Hudon <chrish@debian.org>
Description: 
pppoe      - PPP over Ethernet driver
Changes: 
rp-pppoe (3.5-4) unstable; urgency=high
.
  * Added patch by Max Vozeler <max@hinterhof.net> to ignore -D and -p
    when pppoe is not running as root to prevent a potential root
    compromise by users in group dip when pppoe is running setuid root.
    [src/pppoe.c, CAN-2004-0564] Note that group dip is empty by default
    on Debian installs.

 Christian

Send a report that this bug log contains spam.