MeeGo alert MeeGo-SA-10:03 (abrt)

From:
    	     
 
"Ware, Ryan R" <ryan.r.ware@intel.com> 
To:
    	     
 
"meego-security@meego.com" <meego-security@meego.com> 
Subject:
    	     
 
[MeeGo-security] [MeeGo-SA-10:03.abrt] Vulnerability in abrt
	(Corrected) 
Date:
    	     
 
Wed, 7 Jul 2010 14:16:11 -0700
Message-ID:
    	     
 
<C85A3CAB.14E58%ryan.r.ware@intel.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
==
MeeGo-SA-10:03.abrt                Security Advisory
                                                                MeeGo
Project

Topic:          Vulnerability in abrt

Category:       Automatic bug detection and reporting tool
Module:         abrt-addon-python
Announced:      July 7, 2010
Affects:        MeeGo 1.0
Corrected:      July 7, 2010
MeeGo BID: 2438
CVE:  none

For general information regarding MeeGo Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://www.MeeGo.com/>.

I.   Background

abrt is a tool to help users to detect defects in applications and
to create a bug report with all informations needed by maintainer
to fix it. It uses plugin system to extend its functionality.

The abrt-addon-python package contains the python hook and analyzer
for handling uncaught exceptions in python programs. 

II.  Problem Description

The file /usr/libexec/abrt-hook-python is setuid as the abrt user.
As there is no explicit reason to be setuid as the abrt user, this
violates best known practices for security; specifically by not using
the priniciples of least privilege and unintentionally expanding the
attackable surface area of MeeGo.

III. Impact

A security vulnerability in the abrt-hook-python module would allow
arbitrary code execution as the abrt user. (CWE-250)

IV.  Workaround

None

V.   Solution

Update to package abrt-addon-python-1.0.8-11.1 or later.

VI. References

http://bugs.meego.com/show_bug.cgi?id=2438
http://cwe.mitre.org/data/definitions/250.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)

iQEcBAEBAgAGBQJMNO5FAAoJECxjfBlj7RcKZ7IH/33bIGODuWFZUa+96eALbRva
lwkvyom1Lx3diTijabvZIkcULI5l5Sy8vlxW0EPlp1bQmBvzlWnD/sXS3zI2Vn1F
b7Z51KPTYUSLQ+rDtUf6Tek7eDwGK44ri+7maiRXQnZm/09042pKLVKqvjtLz0a4
Ai8fSWGENSSr3jtefL6xuCEDvIbWutom/fiPYre1+VTGHLIhh8bXNjiQ5duNb2xH
T3CdwclYU7xn/WFojOgAljEqrHyUjmvN+MH8qW1P2N2Z/f3eW+rDUdaVxMLYV6ty
Qq0PlpS5WZd9HBmOjPpgbCQ5qyDq3BeIc7E0H6pzKZMJ5gwRnGfRYc3vXgF8SO8=
=H1Hx
-----END PGP SIGNATURE-----

_______________________________________________
MeeGo-security mailing list
MeeGo-security@meego.com
http://lists.meego.com/listinfo/meego-security