Package: davfs2 Version: 1.4.6-1.1 Severity: critical Tags: patch, security, upstream davfs2 calls function system several times. Because davfs2 is setuid root in many cases this will allow for privilege escalation. Appended are patches for version 1.4.6 and 1.4.7 that will fix this bug. Note: as a consequence davfs2 will no longer try to insert required kernel modules or create device special files /dev/fuse or /dev/codaX. So the user has to make sure that one of these devices exists before mounting a davfs2 file system. As far as I can see /dev/fuse is created by default on Debian systems. davfs2 uses /dev/fuse by default (and not /dev/codaX). So this bug fix should not cause any problem on Debian systems. Werner (upstream maintainer) diff -ur davfs2-1.4.7/ChangeLog davfs2-1.4.7.new/ChangeLog --- davfs2-1.4.7/ChangeLog 2012-07-19 13:37:52.000000000 +0200 +++ davfs2-1.4.7.new/ChangeLog 2013-09-15 10:19:12.000000000 +0200 @@ -1,6 +1,11 @@ ChangeLog for davfs2 -------------------- +2013-09-08 Werner Baumann (werner.baumann@onlinehome.de) + * kernel_interface.c, mount_davfs.c: + Don't create /dev/coda and /dev/fuse. + Remove insecure calls of system(). + 2012-07-19 Werner Baumann (werner.baumann@onlinehome.de) * Release version 1.4.7. diff -ur davfs2-1.4.7/src/kernel_interface.c davfs2-1.4.7.new/src/kernel_interface.c --- davfs2-1.4.7/src/kernel_interface.c 2012-07-19 12:58:48.000000000 +0200 +++ davfs2-1.4.7.new/src/kernel_interface.c 2013-09-15 10:15:07.000000000 +0200 @@ -167,29 +167,6 @@ ++minor; } - if (*dev <= 0 && system("/sbin/modprobe coda &>/dev/null") == 0) { - minor = 0; - while (*dev <= 0 && minor < MAX_CODADEVS) { - char *path; - if (asprintf(&path, "%s/%s%i", - DAV_DEV_DIR, CODA_DEV_NAME, minor) < 0) - abort(); - *dev = open(path, O_RDWR | O_NONBLOCK); - if (*dev <= 0) { - if (mknod(path, S_IFCHR, makedev(CODA_MAJOR, minor)) == 0) { - if (chown(path, 0, 0) == 0 - && chmod(path, S_IRUSR | S_IWUSR) == 0) { - *dev = open(path, O_RDWR | O_NONBLOCK); - } else { - remove(path); - } - } - } - free(path); - ++minor; - } - } - if (*dev <= 0) { error(0, 0, _("no free coda device to mount")); return -1; @@ -225,20 +202,6 @@ abort(); *dev = open(path, O_RDWR | O_NONBLOCK); - if (*dev <= 0 && system("/sbin/modprobe fuse &>/dev/null") == 0) { - *dev = open(path, O_RDWR | O_NONBLOCK); - } - if (*dev <= 0) { - if (mknod(path, S_IFCHR, makedev(FUSE_MAJOR, FUSE_MINOR)) == 0) { - if (chown(path, 0, 0) == 0 - && chmod(path, S_IRUSR | S_IWUSR) == 0) { - *dev = open(path, O_RDWR | O_NONBLOCK); - } else { - remove(path); - } - } - } - free(path); if (*dev <= 0) { error(0, 0, _("can't open fuse device")); diff -ur davfs2-1.4.7/src/mount_davfs.c davfs2-1.4.7.new/src/mount_davfs.c --- davfs2-1.4.7/src/mount_davfs.c 2012-07-19 13:35:11.000000000 +0200 +++ davfs2-1.4.7.new/src/mount_davfs.c 2013-09-15 10:15:22.000000000 +0200 @@ -170,6 +170,9 @@ static int arg_to_int(const char *arg, int base, const char *opt); +static void +cp_file(const char *src, const char *dest); + static int debug_opts(const char *s); @@ -530,10 +533,7 @@ char *file_name = ne_concat(path, "/", DAV_CONFIG, NULL); if (access(file_name, F_OK) != 0) { char *template = ne_concat(DAV_DATA_DIR, "/", DAV_CONFIG, NULL); - char *command = ne_concat("cp ", template, " ", file_name, - NULL); - if (system(command) != 0); - free(command); + cp_file(template, file_name); free(template); } free(file_name); @@ -542,11 +542,7 @@ if (access(file_name, F_OK) != 0) { char *template = ne_concat(DAV_DATA_DIR, "/", DAV_SECRETS, NULL); - char *command = ne_concat("cp ", template, " ", file_name, - NULL); - if (system(command) == 0) - chmod(file_name, S_IRUSR | S_IWUSR); - free(command); + cp_file(template, file_name); free(template); } free(file_name); @@ -1304,6 +1300,7 @@ opt : name of the option, arg belongs to. Used in the error message. return value: the value of the integer number in arg */ static int + arg_to_int(const char *arg, int base, const char *opt) { char *tail = NULL; @@ -1325,6 +1322,34 @@ } +/* Creates a copy of src with name dest. */ +static void +cp_file(const char *src, const char *dest) +{ + FILE *in = fopen(src, "r"); + if (!in) + error(EXIT_FAILURE, errno, _("can't open file %s"), src); + + FILE *out = fopen(dest, "w"); + if (!out) + error(EXIT_FAILURE, errno, _("can't open file %s"), dest); + + size_t n = 0; + char *line = NULL; + int length = getline(&line, &n, in); + while (length > 0) { + if (fputs(line, out) == EOF) + error(EXIT_FAILURE, errno, _("error writing to file %s"), dest); + length = getline(&line, &n, in); + } + + if (line) + free(line); + fclose(out); + fclose(in); +} + + /* Converts a debug option string s into numerical value. If s is not a valid debug option, it returns 0. */ static int