CVE-2016-4445 (published 2017-04-11T18:59Z)

The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.

Severity: MEDIUM
CVSS v2 base score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.0, HIGH (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/fedora-selinux/setroubleshoot
commit_details: repo_url: https://github.com/fedora-selinux/setroubleshoot
author: Petr Lautrbach
author_date: 2015-04-09 14:08:14+02:00
msg: framework: get rid of commands.getstatusoutput()
repository: repo_url: https://github.com/fedora-selinux/setroubleshoot
repo_name: fedora-selinux/setroubleshoot
description: Abandoned, use https://gitlab.com/setroubleshoot
repo_language: Python
owner: fedora-selinux
file_changes: filename: sealert
change_type: ModificationType.MODIFY
diff: @@ -141,7 +141,7 @@ def fix_lookup_id(local_id, analysis_id):
         async_rpc.add_errback(query_alerts_error)
 
     def query_alerts_callback(sigs):
-        import commands
+        import subprocess
         for siginfo in sigs.signature_list:
             for plugin  in siginfo.plugin_list:
                 if analysis_id == plugin.analysis_id:
@@ -151,12 +151,12 @@ def fix_lookup_id(local_id, analysis_id):
                         cl.main_loop.quit()
                         return
                     siginfo.update_derived_template_substitutions()
-                    command = siginfo.substitute(p.get_fix_cmd(siginfo.audit_event, plugin.args))
-                    rc, output = commands.getstatusoutput(command)
-                    if rc == 0:
-                        print _("Successfully ran %s" % command)
-                    else:
-                        print output
+                    command = siginfo.substitute_array(p.get_fix_cmd(siginfo.audit_event, plugin.args).split())
+                    try:
+                        output = subprocess.check_output(command)
+                        print _("Successfully ran %s" % ' '.join(command))
+                    except subprocess.CalledProcessError as e:
+                        print(e.output)
                     cl.main_loop.quit()
                     return
         print _("Plugin %s not valid for %s id") % (analysis_id, local_id)

programming_language: Python
filename: signature.py
change_type: ModificationType.MODIFY
diff: @@ -460,6 +460,9 @@ class SEFaultSignatureInfo(XmlSerialize):
     def substitute(self, txt):
         return Template(txt).safe_substitute(self.template_substitutions)
 
+    def substitute_array(self, args):
+        return [self.substitute(txt) for txt in args]
+
     def format_details(self, replace=False):
         env = self.environment
 

programming_language: Python