CVE-2014-0039: Other (NVD-CWE-Other)
value: Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-02-08T00:55Z
Repository: https://github.com/mrash/fwsnort
Language: Other
Files changed: CREDITS, ChangeLog, fwsnort, fwsnort.8
Commit date: 2014-02-01 14:58:22 -0500
Commit message: Bug fix for CVE-2014-0039

Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
the Red Hat Security Team in which an attacker-controlled fwsnort.conf
file could be read by fwsnort when not running as root.  This was caused
by fwsnort reading './fwsnort.conf' when not running as root and when a
path to the config file was not explicitly set with -c on the command
line.  This behavior has been changed to require the user to specify a
path to fwsnort.conf with -c when not running as root.

Diff: diff --git a/CREDITS b/CREDITS
index 96941ce..d36bf79 100644
--- a/CREDITS
+++ b/CREDITS
@@ -88,5 +88,14 @@ Dwight Davis
     - Contributed patches for several bugs including not handling
       --exclude-regex properly, not ignoring the deleted.rules file, not
       handling --strict mode opertions correctly, and more.  These issues and
       the corresponding patch were originally reported here:
         http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693000
+
+Murray McAllister (Red Hat Security Team)
+    - Reported a bug fix for vulnerability CVE-2014-0039 in which an attacker-
+      controlled fwsnort.conf file could be read by fwsnort when not running as
+      root.  This was caused by fwsnort reading './fwsnort.conf' when not
+      running as root and when a path to the config file was not explicitly set
+      with -c on the command line.  This behavior has been changed to require
+      the user to specify a path to fwsnort.conf with -c when not running as
+      root.
diff --git a/ChangeLog b/ChangeLog
index 050c7bd..7fc3a37 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
+fwsnort-1.6.4 (02//2014):
+    - Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
+      the Red Hat Security Team in which an attacker-controlled fwsnort.conf
+      file could be read by fwsnort when not running as root.  This was caused
+      by fwsnort reading './fwsnort.conf' when not running as root and when a
+      path to the config file was not explicitly set with -c on the command
+      line.  This behavior has been changed to require the user to specify a
+      path to fwsnort.conf with -c when not running as root.
+
 fwsnort-1.6.3 (12/21/2012):
     - Bug fix to ensure that !, <, >, and = chars in content strings are
       converted to the appropriate hex equivalents.  All content strings with
       characters outside of [A-Za-z0-9] are now converted to hex-string format
       in their entirety.  This should also fix an issue that results in the
diff --git a/fwsnort b/fwsnort
index 7a03713..e8f21ef 100755
--- a/fwsnort
+++ b/fwsnort
@@ -4658,12 +4658,14 @@ sub is_root() {
     }
     return;
 }
 
 sub set_non_root_values() {
+
     if ($fwsnort_conf eq $CONFIG_DEFAULT) {
-        $fwsnort_conf = './fwsnort.conf';
+        die "[*] Must specify a path to readable ",
+            "fwsnort.conf file when not running as root.";
     }
 
     &set_defaults_without_ipt_test();
     return;
 }
diff --git a/fwsnort.8 b/fwsnort.8
index 0b49397..353eebe 100644
--- a/fwsnort.8
+++ b/fwsnort.8
@@ -80,11 +80,12 @@ is able to apply Snort rules to IPv6 traffic by building an ip6tables policy
 .BR \-c ", " \-\^\-config\ \<configuration\ file>
 By default fwsnort makes use of the configuration file
 .B /etc/fwsnort/fwsnort.conf
 for almost all configuration parameters.  fwsnort can be made to
 override this path by specifying a different file on the command
-line with the \-\-config option.
+line with the \-\-config option.  When fwsnort is not executed as root, then
+a path to a readable fwsnort.conf file is required.
 .TP
 .BR \-\^\-update-rules
 Download the latest Emerging Threats rules from http://www.emergingthreats.net
 This will overwrite the  emerging-all.rules file in the
 /etc/fwsnort/snort_rules/ directory.  Note that the automatic downloading

Vulnerable code:         $fwsnort_conf = './fwsnort.conf';
line with the \-\-config option.
Fixed code: 
Murray McAllister (Red Hat Security Team)
    - Reported a bug fix for vulnerability CVE-2014-0039 in which an attacker-
      controlled fwsnort.conf file could be read by fwsnort when not running as
      root.  This was caused by fwsnort reading './fwsnort.conf' when not
      running as root and when a path to the config file was not explicitly set
      with -c on the command line.  This behavior has been changed to require
      the user to specify a path to fwsnort.conf with -c when not running as
      root.
fwsnort-1.6.4 (02//2014):
    - Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
      the Red Hat Security Team in which an attacker-controlled fwsnort.conf
      file could be read by fwsnort when not running as root.  This was caused
      by fwsnort reading './fwsnort.conf' when not running as root and when a
      path to the config file was not explicitly set with -c on the command
      line.  This behavior has been changed to require the user to specify a
      path to fwsnort.conf with -c when not running as root.


        die "[*] Must specify a path to readable ",
            "fwsnort.conf file when not running as root.";
line with the \-\-config option.  When fwsnort is not executed as root, then
a path to a readable fwsnort.conf file is required.