The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-152:01 advisory.

    Security-enhanced Linux is a feature of the Linux kernel and a number of utilities with enhanced security     functionality designed to add mandatory access controls to Linux.  The Security-enhanced Linux kernel     contains new architectural components originally developed to improve the security of the Flask operating     system. These architectural components provide general support for the enforcement of many kinds of     mandatory access control policies, including those based on the concepts of Type Enforcement, Role-based     Access Control, and Multi-level Security.
    policycoreutils contains the policy core utilities that are required for basic operation of a SELinux     system.  These utilities include load_policy to load policies, setfiles to label filesystems, newrole to     switch roles, and run_init to run /etc/init.d scripts in the proper context.
    Security issues fixed with this release:
    CVE-2011-1011     The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Asianux packages of     policycoreutils 2.0.83 and earlier in Asianux Server 4 and earlier, mounts a new directory on top of /tmp     without assigning root ownership and the sticky bit to this new directory, which allows local users to     replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain     privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0414 advisory.

    policycoreutils:

    [2.0.83-19.8]
    - Fix seunshare to work with /tmp content when SELinux context is not provided     Resolves: #679689

    [2.0.83-19.7]
    - put back correct chcon
    - Latest fixes for seunshare

    [2.0.83-19.6]
    - Fix rsync command to work if the directory is old.
    - Fix all tests     Resolves: #679689

    [2.0.83-19.5]
    - Add requires rsync and  fix man page for seunshare

    [2.0.83-19.4]
    - fix to sandbox
      - Fix seunshare to use more secure handling of /tmp
        - Rewrite seunshare to make sure /tmp is mounted stickybit owned by root
       - Change to allow sandbox to run on nfs homedirs, add start python script
       - change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_*
       - Move seunshare to sandbox package
       - Fix sandbox to show correct types in  usage statement

    selinux-policy:

    [3.7.19-54.0.1.el6_0.5]
    - Allow ocfs2 to be mounted with file_t type.

    [3.7.19-54.el6_0.5]
    - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs     Resolves: #684918

    [3.7.19-54.el6_0.4]
    - Fix to sandbox
            * selinux-policy fixes for policycoreutils sandbox changes
                    - Fix seunshare to use more secure handling of /tmp
                    - Change to allow sandbox to run on nfs homedirs, add start python script

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The policycoreutils packages contain the core utilities that are required for the basic operation of a Security-Enhanced Linux (SELinux) system and its policies.

It was discovered that the seunshare utility did not enforce proper file permissions on the directory used as an alternate temporary directory mounted as /tmp/. A local user could use this flaw to overwrite files or, possibly, execute arbitrary code with the privileges of a setuid or setgid application that relies on proper /tmp/ permissions, by running that application via seunshare.
(CVE-2011-1011)

This update also introduces the following changes :

  - The seunshare utility was moved from the main     policycoreutils subpackage to the     policycoreutils-sandbox subpackage. This utility is only     required by the sandbox feature and does not need to be     installed by default.

  - Updated selinux-policy packages that add the SELinux     policy changes required by the seunshare fixes.

All policycoreutils users should upgrade to these updated packages, which correct this issue.

Updated policycoreutils packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The policycoreutils packages contain the core utilities that are required for the basic operation of a Security-Enhanced Linux (SELinux) system and its policies.

It was discovered that the seunshare utility did not enforce proper file permissions on the directory used as an alternate temporary directory mounted as /tmp/. A local user could use this flaw to overwrite files or, possibly, execute arbitrary code with the privileges of a setuid or setgid application that relies on proper /tmp/ permissions, by running that application via seunshare.
(CVE-2011-1011)

Red Hat would like to thank Tavis Ormandy for reporting this issue.

This update also introduces the following changes :

* The seunshare utility was moved from the main policycoreutils subpackage to the policycoreutils-sandbox subpackage. This utility is only required by the sandbox feature and does not need to be installed by default.

* Updated selinux-policy packages that add the SELinux policy changes required by the seunshare fixes.

All policycoreutils users should upgrade to these updated packages, which correct this issue.

This fixes the problem with seunshare causing applications to mistakenly use the /tmp directory in an unsafe manner.

CVE-2011-1011

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
291420	MiracleLinux 4 : selinux-policy-3.7.19-54.AXS4.5, policycoreutils-2.0.83-19.8.AXS4 (AXSA:2011-152:01)	Nessus	Miracle Linux Local Security Checks	high
68246	Oracle Linux 6 : policycoreutils (ELSA-2011-0414)	Nessus	Oracle Linux Local Security Checks	high
61009	Scientific Linux Security Update : policycoreutils on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53293	RHEL 6 : policycoreutils (RHSA-2011:0414)	Nessus	Red Hat Local Security Checks	medium
52721	Fedora 14 : policycoreutils-2.0.85-19.fc14 (2011-3043)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1011

high

Tenable Plugins

high

high

medium

medium

medium