Debian tmpreaper 1.6.13+nmu1 /etc/cron.d/ rename race condition

Summaryinfo

A vulnerability classified as critical was found in Debian tmpreaper 1.6.13+nmu1. This impacts the function rename of the file /etc/cron.d/. Executing a manipulation can lead to race condition. This vulnerability is registered as CVE-2019-3461. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Debian tmpreaper 1.6.13+nmu1. It has been declared as critical. This vulnerability affects the function rename of the file /etc/cron.d/. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in local privilege escalation. Mounting via rename() could potentially lead to a file being placed elsewhereon the filesystem hierarchy (e.g. /etc/cron.d/) if the directory being cleaned up was on the same physical filesystem. Fixed versions include 1.6.13+nmu1+deb9u1 and 1.6.14.

The bug was discovered 01/10/2019. The weakness was published 02/04/2019 (Website). The advisory is shared for download at lists.debian.org. This vulnerability was named CVE-2019-3461 since 12/31/2018. The attack needs to be approached locally. The successful exploitation requires a single authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 121134 (Debian DSA-4365-1 : tmpreaper - security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 176716 (Debian Security Update for tmpreaper (DLA 1640-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (121134). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Debian

Name

• tmpreaper

Version

• 1.6.13+nmu1

License

• open-source

Website

• Vendor: https://www.debian.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion