CVE-2014-0039 (published 2014-02-08T00:55Z)

Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.

Severity: MEDIUM
CVSS v2 base score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mrash/fwsnort
commit_details: repo_url: https://github.com/mrash/fwsnort
author: Michael Rash
author_date: 2014-02-01 14:58:22-05:00
msg: Bug fix for CVE-2014-0039

Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
the Red Hat Security Team in which an attacker-controlled fwsnort.conf
file could be read by fwsnort when not running as root.  This was caused
by fwsnort reading './fwsnort.conf' when not running as root and when a
path to the config file was not explicitly set with -c on the command
line.  This behavior has been changed to require the user to specify a
path to fwsnort.conf with -c when not running as root.
repository: repo_url: https://github.com/mrash/fwsnort
repo_name: mrash/fwsnort
description: Application Layer IDS/IPS with iptables
repo_language: Perl
owner: mrash
file_changes: filename: CREDITS
change_type: ModificationType.MODIFY
diff: @@ -90,3 +90,12 @@ Dwight Davis
       handling --strict mode opertions correctly, and more.  These issues and
       the corresponding patch were originally reported here:
         http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693000
+
+Murray McAllister (Red Hat Security Team)
+    - Reported a bug fix for vulnerability CVE-2014-0039 in which an attacker-
+      controlled fwsnort.conf file could be read by fwsnort when not running as
+      root.  This was caused by fwsnort reading './fwsnort.conf' when not
+      running as root and when a path to the config file was not explicitly set
+      with -c on the command line.  This behavior has been changed to require
+      the user to specify a path to fwsnort.conf with -c when not running as
+      root.

programming_language: Markdown
filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,12 @@
+fwsnort-1.6.4 (02//2014):
+    - Bug fix for vulnerability CVE-2014-0039 reported by Murray McAllister of
+      the Red Hat Security Team in which an attacker-controlled fwsnort.conf
+      file could be read by fwsnort when not running as root.  This was caused
+      by fwsnort reading './fwsnort.conf' when not running as root and when a
+      path to the config file was not explicitly set with -c on the command
+      line.  This behavior has been changed to require the user to specify a
+      path to fwsnort.conf with -c when not running as root.
+
 fwsnort-1.6.3 (12/21/2012):
     - Bug fix to ensure that !, <, >, and = chars in content strings are
       converted to the appropriate hex equivalents.  All content strings with

programming_language: Markdown
filename: fwsnort
change_type: ModificationType.MODIFY
diff: @@ -4660,8 +4660,10 @@ sub is_root() {
 }
 
 sub set_non_root_values() {
+
     if ($fwsnort_conf eq $CONFIG_DEFAULT) {
-        $fwsnort_conf = './fwsnort.conf';
+        die "[*] Must specify a path to readable ",
+            "fwsnort.conf file when not running as root.";
     }
 
     &set_defaults_without_ipt_test();

programming_language: Perl
filename: fwsnort.8
change_type: ModificationType.MODIFY
diff: @@ -82,7 +82,8 @@ By default fwsnort makes use of the configuration file
 .B /etc/fwsnort/fwsnort.conf
 for almost all configuration parameters.  fwsnort can be made to
 override this path by specifying a different file on the command
-line with the \-\-config option.
+line with the \-\-config option.  When fwsnort is not executed as root, then
+a path to a readable fwsnort.conf file is required.
 .TP
 .BR \-\^\-update-rules
 Download the latest Emerging Threats rules from http://www.emergingthreats.net

programming_language: Shell