CVE-2017-1000215: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2017-11-17T20:29Z
Repository: https://github.com/xrootd/xrootd
Language: C++
Files changed: packaging/rhel/xrootd.spec.in, src/XrdCl/XrdClDefaultEnv.cc, src/XrdSecgsi.cmake, src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc, src/XrdVersionPlugin.hh
Commit date: 2017-04-20 11:08:02 +0200
Commit message: secgsi: do not build/package libXrdSecgsiGMAPLDAP-4.so

The way the LDAP query is implemented may represent a security threat.
Any related building and packaging reference is removed.
The code is left in place (for the time being) to remind its functionality
in the case a sanitized version is required.

Diff: diff --git a/packaging/rhel/xrootd.spec.in b/packaging/rhel/xrootd.spec.in
index 00cbf783..40f09185 100644
--- a/packaging/rhel/xrootd.spec.in
+++ b/packaging/rhel/xrootd.spec.in
@@ -807,11 +807,10 @@ fi
 %{_libdir}/libXrdFfs.so.1*
 %{_libdir}/libXrdPosixPreload.so.0*
 %{_libdir}/libXrdPosix.so.1*
 %{_libdir}/libXrdSecgsiAuthzVO.so*
 %{_libdir}/libXrdSecgsiGMAPDN.so*
-%{_libdir}/libXrdSecgsiGMAPLDAP.so*
 %{_libdir}/libXrdSecgsi.so*
 %{_libdir}/libXrdSeckrb5.so*
 %{_libdir}/libXrdSecpwd.so*
 %{_libdir}/libXrdSec.so*
 %{_libdir}/libXrdSecsss.so*
diff --git a/src/XrdCl/XrdClDefaultEnv.cc b/src/XrdCl/XrdClDefaultEnv.cc
index 47fe02d8..75d2a2fa 100644
--- a/src/XrdCl/XrdClDefaultEnv.cc
+++ b/src/XrdCl/XrdClDefaultEnv.cc
@@ -668,11 +668,10 @@ namespace XrdCl
     {
       "libXrdSeckrb5.so",
       "libXrdSecgsi.so",
       "libXrdSecgsiAuthzVO.so",
       "libXrdSecgsiGMAPDN.so",
-      "libXrdSecgsiGMAPLDAP.so",
       "libXrdSecpwd.so",
       "libXrdSecsss.so",
       "libXrdSecunix.so",
       0
     };
diff --git a/src/XrdSecgsi.cmake b/src/XrdSecgsi.cmake
index eae989f3..1d589051 100644
--- a/src/XrdSecgsi.cmake
+++ b/src/XrdSecgsi.cmake
@@ -3,11 +3,10 @@ include( XRootDCommon )
 
 #-------------------------------------------------------------------------------
 # Shared library version
 #-------------------------------------------------------------------------------
 set( LIB_XRD_SEC_GSI          XrdSecgsi-${PLUGIN_VERSION} )
-set( LIB_XRD_SEC_GSI_GMAPLDAP XrdSecgsiGMAPLDAP-${PLUGIN_VERSION} )
 set( LIB_XRD_SEC_GSI_GMAPDN   XrdSecgsiGMAPDN-${PLUGIN_VERSION} )
 set( LIB_XRD_SEC_GSI_AUTHZVO  XrdSecgsiAUTHZVO-${PLUGIN_VERSION} )
 
 #-------------------------------------------------------------------------------
 # The XrdSecgsi library
@@ -28,24 +27,10 @@ set_target_properties(
   ${LIB_XRD_SEC_GSI}
   PROPERTIES
   INTERFACE_LINK_LIBRARIES ""
   LINK_INTERFACE_LIBRARIES "" )
 
-#-------------------------------------------------------------------------------
-# The XrdSecgsiGMAPLDAP module
-#-------------------------------------------------------------------------------
-add_library(
-  ${LIB_XRD_SEC_GSI_GMAPLDAP}
-  MODULE
-  XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc )
-
-set_target_properties(
-  ${LIB_XRD_SEC_GSI_GMAPLDAP}
-  PROPERTIES
-  INTERFACE_LINK_LIBRARIES ""
-  LINK_INTERFACE_LIBRARIES "" )
-
 #-------------------------------------------------------------------------------
 # The XrdSecgsiAuthzVO module
 #-------------------------------------------------------------------------------
 add_library(
   ${LIB_XRD_SEC_GSI_AUTHZVO}
@@ -110,11 +95,10 @@ target_link_libraries(
 # Install
 #-------------------------------------------------------------------------------
 install(
   TARGETS
   ${LIB_XRD_SEC_GSI}
-  ${LIB_XRD_SEC_GSI_GMAPLDAP}
   ${LIB_XRD_SEC_GSI_AUTHZVO}
   ${LIB_XRD_SEC_GSI_GMAPDN}
   xrdgsiproxy
   xrdgsitest
   RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
diff --git a/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc b/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc
index fbeba5bb..a1d2cad2 100644
--- a/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc
+++ b/src/XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc
@@ -36,10 +36,19 @@ XrdVERSIONINFO(XrdSecgsiGMAPFun,secgsigmap);
 
 /* ************************************************************************** */
 /*                                                                            */
 /* GMAP function implementation querying a LDAP database                      */
 /*                                                                            */
+/* Warning: this plug-in is not build any longer because the external         */
+/* LDAP query via the popen() represents a potential security threat          */
+/* and it is believed that functionality provided is not actually used.       */
+/* If this believe happens to be uncorrect please report at                   */
+/*                                                                            */
+/*                   https://github.com/xrootd                                */
+/*                                                                            */
+/* a sanitized version of the plug-in can be provided using a proper library. */
+/*                                                                            */
 /* ************************************************************************** */
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/src/XrdVersionPlugin.hh b/src/XrdVersionPlugin.hh
index 5e663cc6..d635f205 100644
--- a/src/XrdVersionPlugin.hh
+++ b/src/XrdVersionPlugin.hh
@@ -168,11 +168,10 @@
          "libXrdPss.so",             \
          "libXrdSec.so",             \
          "libXrdSecgsi.so",          \
          "libXrdSecgsiAUTHZVO.so",   \
          "libXrdSecgsiGMAPDLAP.so",  \
-         "libXrdSecgsiGMAPLDAP.so",  \
          "libXrdSeckrb5.so",         \
          "libXrdSecpwd.so",          \
          "libXrdSecsss.so",          \
          "libXrdSecunix.so",         \
          "libXrdXrootd.so",          \

Vulnerable code: %{_libdir}/libXrdSecgsiGMAPLDAP.so*
      "libXrdSecgsiGMAPLDAP.so",
set( LIB_XRD_SEC_GSI_GMAPLDAP XrdSecgsiGMAPLDAP-${PLUGIN_VERSION} )
#-------------------------------------------------------------------------------
# The XrdSecgsiGMAPLDAP module
#-------------------------------------------------------------------------------
add_library(
  ${LIB_XRD_SEC_GSI_GMAPLDAP}
  MODULE
  XrdSecgsi/XrdSecgsiGMAPFunLDAP.cc )

set_target_properties(
  ${LIB_XRD_SEC_GSI_GMAPLDAP}
  PROPERTIES
  INTERFACE_LINK_LIBRARIES ""
  LINK_INTERFACE_LIBRARIES "" )

  ${LIB_XRD_SEC_GSI_GMAPLDAP}
         "libXrdSecgsiGMAPLDAP.so",  \
Fixed code: /* Warning: this plug-in is not build any longer because the external         */
/* LDAP query via the popen() represents a potential security threat          */
/* and it is believed that functionality provided is not actually used.       */
/* If this believe happens to be uncorrect please report at                   */
/*                                                                            */
/*                   https://github.com/xrootd                                */
/*                                                                            */
/* a sanitized version of the plug-in can be provided using a proper library. */
/*                                                                            */