CVE-2020-14976 (published 2020-06-23T20:15Z)

GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:C/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/GNS3/ubridge
commit_details: repo_url: https://github.com/GNS3/ubridge
author: ziajka
author_date: 2019-05-08 16:48:24+02:00
msg: Hide errored line content during parsing configuration INI file on default
repository: repo_url: https://github.com/GNS3/ubridge
repo_name: GNS3/ubridge
description: Bridge for UDP tunnels, Ethernet, TAP and VMnet interfaces.
repo_language: C
owner: GNS3
file_changes: filename: iniparser.c
change_type: ModificationType.MODIFY
diff: @@ -626,7 +626,7 @@ static line_status iniparser_line(
   The returned dictionary must be freed using iniparser_freedict().
  */
 /*--------------------------------------------------------------------------*/
-dictionary * iniparser_load(const char * ininame)
+dictionary * iniparser_load(const char * ininame, load_options options)
 {
     FILE * in ;
 
@@ -707,10 +707,18 @@ dictionary * iniparser_load(const char * ininame)
             break ;
 
             case LINE_ERROR:
-            fprintf(stderr, "iniparser: syntax error in %s (%d):\n",
-                    ininame,
-                    lineno);
-            fprintf(stderr, "-> %s\n", line);
+
+            if(options & HIDE_ERRORED_LINE_CONTENT) {
+              fprintf(stderr, "iniparser: syntax error in %s (%d)\n",
+                      ininame,
+                      lineno);
+            }
+            else {
+              fprintf(stderr, "iniparser: syntax error in %s (%d):\n",
+                      ininame,
+                      lineno);
+              fprintf(stderr, "-> %s\n", line);
+            }
             errs++ ;
             break;
 

programming_language: C
filename: iniparser.h
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,10 @@
 extern "C" {
 #endif
 
+typedef enum {
+  HIDE_ERRORED_LINE_CONTENT = (1<<0)
+} load_options;
+
 /*-------------------------------------------------------------------------*/
 /**
   @brief    Get number of sections in a dictionary
@@ -286,6 +290,7 @@ int iniparser_find_entry(const dictionary * ini, const char * entry) ;
 /**
   @brief    Parse an ini file and return an allocated dictionary object
   @param    ininame Name of the ini file to read.
+  @param    options Name of the ini file to read.
   @return   Pointer to newly allocated dictionary
 
   This is the parser for ini files. This function is called, providing
@@ -296,7 +301,7 @@ int iniparser_find_entry(const dictionary * ini, const char * entry) ;
   The returned dictionary must be freed using iniparser_freedict().
  */
 /*--------------------------------------------------------------------------*/
-dictionary * iniparser_load(const char * ininame);
+dictionary * iniparser_load(const char * ininame, load_options options);
 
 /*-------------------------------------------------------------------------*/
 /**

programming_language: C
filename: parse.c
change_type: ModificationType.MODIFY
diff: @@ -186,7 +186,7 @@ int parse_config(char *filename, bridge_t **bridges)
     const char *bridge_name;
     int i, nsec;
 
-    if ((ubridge_config = iniparser_load(filename)) == NULL) {
+    if ((ubridge_config = iniparser_load(filename, HIDE_ERRORED_LINE_CONTENT)) == NULL) {
        return FALSE;
     }
 

programming_language: C