Bug#754041: "apt-get build-dep <pkgname>" no longer secure when cwd=/tmp
On Sun, Jul 06, 2014 at 11:49:26PM +0200, Jakub Wilk wrote:
> Package: apt
> Version: 1.1~exp1
> Severity: minor
> Tags: security
Thanks for your bugreport.
> First of all, thanks for bringing new exciting features to apt!
>
> I'm afraid, however, that one of these features, namely
> * add support for "apt-get build-dep unpacked-source-dir"
> brought an unanticipated security regression.
>
> Consider the following command:
>
> # apt-get build-dep nyancat
>
> It used to be safe to execute it regardless of what your working
> directory was. But in apt_1.1~exp1, this is no longer secure if cwd
> is a world-writable, for example /tmp. A local malicious user could
> create crafted /tmp/nyancat/debian/control, tricking apt into
> installing packages of their choice. Or they could symlink
> /tmp/nyancat/debian/control to /dev/urandom...
Good point, thanks a lot for bring this to our attention. I changed
the code now so that it prints when using a file/directory so that the
user is aware of it (as suggested by David).
And as you suggested it now enforces that it needs a path starting
with ./ or /.
Thanks,
Michael
> -- System Information:
> Debian Release: jessie/sid
> APT prefers unstable
> APT policy: (990, 'unstable'), (500, 'experimental')
> Architecture: i386 (x86_64)
> Foreign Architectures: amd64
>
> Kernel: Linux 3.14-1-amd64 (SMP w/2 CPU cores)
> Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages apt depends on:
> ii debian-archive-keyring 2012.4
> ii gnupg 1.4.18-1
> ii libapt-pkg4.13 1.1~exp1
> ii libc6 2.19-4
> ii libgcc1 1:4.9.0-10
> ii libstdc++6 4.9.0-10
>
> --
> Jakub Wilk
>
>
> --
> To UNSUBSCRIBE, email to deity-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: [🔎] 20140706214926.GA8271@jwilk.net">https://lists.debian.org/[🔎] 20140706214926.GA8271@jwilk.net
>
Reply to: