Arbitrary diff application hole in upload processor

[William Grant]

A malicious v1.0 source package can apply diffs to arbitrary files on LP upload machines through a directory traversal vulnerability. When dpkg-source runs, paths containing '..' in the diff.gz are followed. This trivially allows appending or prepending to any file writable by the user running process-upload.py, or creation of new files. More creative mutation is likely possible.

This could probably be considered to be a bug in dpkg-source.

[William Grant (wgrant)]

This one just prepends a couple of lines to /tmp/i-append-to-you.

Also note that one can upload PPA packages to cocoplum, so anybody can exploit it there too, not just on germanium.

[Colin Watson (cjwatson)]

I've raised this with Raphaël Hertzog (upstream dpkg-dev maintainer) on IRC; awaiting a response.

[Julian Edwards (julian-edwards)]

Soyuz will wait for a fix in dpkg.

[Raphaël Hertzog (hertzog)]

Here's a preliminary patch that I consider using. Before uploading this I want to check it doesn't cause too many regressions in lenny and sid.

[Raphaël Hertzog (hertzog)]

An updated patch also fixing a similar issue this time related to insecure paths in the series file for 3.0 (quilt) source packages. This patch should also apply on version 1.15 (except for changelog stuff).

[Colin Watson (cjwatson)]

Thanks! I'm running out of steam for today, but will look at this ASAP ...

[Raphaël Hertzog (hertzog)]

Bleh, in my hurry I missed the obvious, the perl regex must be m{/\.\./} and not m{/../}. So the third and hopefully final variant of the patch is attached.

[Raphaël Hertzog (hertzog)]

The DSA is forthcoming, it will be public either tomorrow or wednesday.

[Colin Watson (cjwatson)]

Thanks, I've looked this over and it looks sane to me. I've asked LaMont to apply it to our production instances.

[Kees Cook (kees)]

CVE-2010-0396

[Launchpad Janitor (janitor)]

This bug was fixed in the package dpkg - 1.15.5.6ubuntu2

---------------
dpkg (1.15.5.6ubuntu2) lucid; urgency=high

  * Backport from upstream:
    - Use FIEMAP when available (on Linux based systems) to sort the .list
      files loading order. With a cold cache it improves up to a 70%.
      Thanks to Morten Hustveit <email address hidden>. LP: #442114
    - Call fsync(2) after writing files on disk, to get the atomicity
      guarantees when doing rename(2). Based on a patch by Jean-Baptiste
      Lallement <email address hidden>.
      Closes: #430958, LP: #512096
  * Security fixes by Raphaël Hertzog, also backported from upstream
    (CVE-2010-0396):
    - Modify dpkg-source to error out when it would apply patches containing
      insecure paths (with "/../") and also error out when it would apply a
      patch through a symlink. Those checks are required as patch will
      happily modify files outside of the target directory and unpacking a
      source package should not be able to have any side-effect outside of
      the target directory. LP: #532445
    - Also error out when the quilt series contains a path with "/../" as
      this can cause patch to create files outside of the source package due
      to the -B .pc/$path option that it gets.
 -- Colin Watson <email address hidden> Thu, 11 Mar 2010 00:34:28 +0000

[Kees Cook (kees)]

http://www.ubuntu.com/usn/USN-909-1