Bug 8644

Summary: Multiple CVEs on 2.0 release
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Mihail Stanciu <stanciux.mihail>
Component: coreAssignee: Armin Kuster <akuster>
Status: RESOLVED FIXED QA Contact: Mihail Stanciu <stanciux.mihail>
Severity: normal    
Priority: Medium CC: meta.mr.watcher, meta.watcher
Version: 2.0   
Target Milestone: 2.0.1   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: New (Never tested)
Verified: Documentation change: Don't know

Description Mihail Stanciu 2015-11-04 17:01:37 UTC 
Apologies if classification isn't proper, I wasn't sure where this should go.

While looking into automating a CVE check tool to be run on our QA infrastructure found the following CVEs present in the project:

readline 6.3 (0 patched, 1 issues)
------------
 * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.


busybox 1.15.1 (0 patched, 2 issues)
------------
 * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.

 * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.


expat 2.1.0 (0 patched, 1 issues)
------------
 * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Comment 1 Armin Kuster 2015-11-05 16:39:12 UTC 
Mihail,

Thanks for informing us of these issues. We do prefer one bug per package or cve. Each CVE gets a CVSS scoring which will affect the priority of a bug. This allows us to manage resources better. 

thanks
Comment 2 Armin Kuster 2015-11-06 01:40:29 UTC 
(In reply to comment #0)
> Apologies if classification isn't proper, I wasn't sure where this should go.
> 
> While looking into automating a CVE check tool to be run on our QA
> infrastructure found the following CVEs present in the project:
> 
> readline 6.3 (0 patched, 1 issues)
> ------------
>  * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before
> 6.3 patch 3 allows local users to create or overwrite arbitrary files via a
> symlink attack on a /var/tmp/rltrace.[PID] file.

Readline fixed via:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-core/readline?h=master-next&id=9a02df0e932106bcb3dda0a7a2eb1113719fb4ee

in master and Jethro. Informed Fido maintainer to backport.

> 
> 
> busybox 1.15.1 (0 patched, 2 issues)
> ------------
>  * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows
> remote DHCP servers to execute arbitrary commands via shell metacharacters
> in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4)
> TFTP_SERVER_NAME host name options.
> 
>  * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777
> permissions for parent directories when creating nested directories under
> /dev/, which allows local users to have unknown impact and attack vectors.
> 

CVE-2011-2716: affects 1.20 and below.
Master, Jethro nor Dizzy affected.

CVE-2013-1813: Affects 1.21 and below.
Master, Jethro nor Dizzy affected.

> 
> expat 2.1.0 (0 patched, 1 issues)
> ------------
>  * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities
> expansion unless an application developer uses the XML_SetEntityDeclHandler
> function, which allows remote attackers to cause a denial of service
> (resource consumption), send HTTP requests to intranet servers, or read
> arbitrary files via a crafted XML document, aka an XML External Entity (XXE)
> issue.  NOTE: it could be argued that because expat already provides the
> ability to disable external entity expansion, the responsibility for
> resolving this issue lies with application developers; according to this
> argument, this entry should be REJECTed, and each affected application would
> need its own CVE.

Expat response:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=8609