Arbitrary Code Execution via pathtoclam config setting

[Hugh Davenport]

This bug is related to bug #1055232

The ability of the administrator to set the path to clamav can be
abused. For instance changing the path to clamav from '/path/to/av' to
'/path/to/maharadata/artefact/file/originals/9/9' can cause a
malicious uploaded file to be executed. This requires that the saved file
is set to executable on upload, which currently it is.

They could also potentially set it to /bin/bash, allowing any user to upload
a shell script that doesn't require the executable bit set to run.

Fixes:
- Because installing antivirus will require shell access to the
server it seems reasonable to require setting the path to the AV be
done in a configuration file rather than a settings page. It could be
argued that in web applications generally, admin web access should not
be equivalent to shell access, due to relatively ease of session
compromise (as compared to shell access).
- Uploaded files should not be set to executable.

[Hugh Davenport (hugh-davenport)]

First fix, for master

[Hugh Davenport (hugh-davenport)]

First fix, for 1.4

[Hugh Davenport (hugh-davenport)]

First fix, for 1.2

[Hugh Davenport (hugh-davenport)]

Second fix, for master

[Hugh Davenport (hugh-davenport)]

Second fix, upgrade script to remove existing executable bits. For master

[Hugh Davenport (hugh-davenport)]

2nd fix upgrade, 1.6

[Hugh Davenport (hugh-davenport)]

2nd fix upgrade 1.5

[Hugh Davenport (hugh-davenport)]

2nd fix, for 1.4

[Hugh Davenport (hugh-davenport)]

2nd fix, 1.4 upgrade

[Hugh Davenport (hugh-davenport)]

2nd fix, 1.2 upgrade

[Hugh Davenport (hugh-davenport)]

Sorry, these bugs have the wrong bug number in the commit message, as they came from bug #1055232 originally. I will change them in my git branch for when we release.

Also, the -2 meaning 1st fix and -3 meaning 2nd fix may be confusing to some.

[Hugh Davenport (hugh-davenport)]

If there is no patch for the version you wish to patch, then pick the next highest version and so on until you hit the master patches. ie bug-1055232-3-14.patch is for 1.2, 1.3 and 1.4 for fix 2

[Hugh Davenport (hugh-davenport)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 status fixreleased
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iJwEAQECAAYFAlCbHO8ACgkQuMoJ2LQ3zxH8TAP/YN4BiCJZsn5a899/0UzV31Qg
lM8LXAwZWa6zFv6t0BQUHCqe6eFK9wPp51qgCWWXjUZ3vvvVcsyeWp6626aBFKSU
pCQXI9E7huPw802nJQ9WcZXRBUmgw87ww72Tx4mybnu7SPSrkZgXdnPGSMwDs89N
oWvTpl7Xuac48e6p0lU=
=ouU+
-----END PGP SIGNATURE-----