Debian
lightdm package

files written as root to user-controlled folders

Bug #834079 reported by Yves-Alexis Perez
274
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Light Display Manager
Fix Released
High
Martin Pitt
lightdm (Debian)
Fix Released
Unknown
lightdm (Ubuntu)
Fix Released
High
Martin Pitt
Ubuntu ubuntu-11.10
Oneiric
Fix Released
High
Martin Pitt
Ubuntu ubuntu-11.10

Bug Description

Hey,

as you were on CC: I guess you're already aware, but reporting so it can be tracked upstream.

Short version: http://seclists.org/oss-sec/2011/q3/393

Long version: .dmrc and Xauthority files are written by lightdm running as root while they're in user controlled folders. An user can, via a symlink, overwrite root-owned files. It doesn't look like it can achieve easily privilege-escalation (since the content is quite fixed) but it's still bad.

Basically the correct fix seems to have workers process which would setuid() to the user before writing content to those files.

CVE-2011-3349

See original description

Related branches

lp://staging/~pitti/lightdm/write-user-files-as-user
LightDM Development Team: Pending requested
Diff: 116 lines (+38/-12)
3 files modified
NEWS (+1/-0)
src/dmrc.c (+15/-2)
src/xauthority.c (+22/-10)

CVE References

Yves-Alexis Perez (corsac)
visibility: private → public
Bug Watch Updater (bug-watch-updater)
Changed in lightdm (Debian):
status: Unknown → Confirmed
Robert Ancell (robert-ancell)
Changed in lightdm:
status: New → Triaged
importance: Undecided → High
Revision history for this message
Robert Ancell (robert-ancell) wrote :

OpenSUSE audit of lightdm:
https://bugzilla.novell.com/show_bug.cgi?id=708205

Jamie Strandboge (jdstrand)
Changed in lightdm (Ubuntu Oneiric):
importance: Undecided → High
Sebastien Bacher (seb128)
Changed in lightdm (Ubuntu Oneiric):
assignee: nobody → Robert Ancell (robert-ancell)
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Added a 11.10 milestone since I don't know when this is planning on getting fixed, but we definitely don't want to release with this (as I'm sure we all agree :).

Changed in lightdm (Ubuntu Oneiric):
status: New → Triaged
milestone: none → ubuntu-11.10
Revision history for this message
Yves-Alexis Perez (corsac) wrote :

Robert, any news?

Revision history for this message
Robert Ancell (robert-ancell) wrote :

Absolutely agree, needs to be fixed for 1.0 (and 11.10 for Ubuntu).

Martin Pitt (pitti)
Changed in lightdm (Ubuntu Oneiric):
assignee: Robert Ancell (robert-ancell) → Martin Pitt (pitti)
status: Triaged → In Progress
Martin Pitt (pitti)
description: updated
Revision history for this message
Martin Pitt (pitti) wrote :

I can replicate the bug with creating a root owned /rootfile and ln -s /rootfile ~/.Xauthority. lightdm changes /rootfile then.

Writing ~/.dmrc uses g_file_set_contents() which is safe against symlink attacks. However, it's still more robust to drop privileges instead of chown()ing.

Revision history for this message
Martin Pitt (pitti) wrote :

Merge proposal sent.

Changed in lightdm (Ubuntu Oneiric):
status: In Progress → Fix Committed
Changed in lightdm:
status: Triaged → Fix Committed
assignee: nobody → Martin Pitt (pitti)
status: Fix Committed → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

Forgot to mention in changelog:

lightdm (0.9.5-0ubuntu2) oneiric; urgency=low

  * debian/lightdm.config: When installing from scratch as part of a release
    upgrade, default to lightdm, otherwise ask. (LP: #806559)
  * Add 04_dont_write_files_as_root.patch: Do not write ~/.dmrc and
    ~/.Xauthority as root. [CVE-2011-3349]
  * Add 00upstream_unlock_fix.patch: Only unlock displays if switched to from
    greeter. Cherrypicked from upstream r1137. (LP: #844274)

 -- Martin Pitt <email address hidden> Thu, 15 Sep 2011 08:52:24 +0200

Also fixed upstream now in 0.9.6.

Changed in lightdm (Ubuntu Oneiric):
status: Fix Committed → Fix Released
Changed in lightdm:
status: In Progress → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in lightdm (Debian):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.