CVE-2014-5449: Incorrect default permissions in Zarafa

Am 15. August 2014 habe ich entdeckt, dass die standardmäßigen Verzeichnisberechtigungen von "/var/lib/zarafa-webaccess/tmp/" (Zarafa WebAccess) und "/var/lib/zarafa-webapp/tmp/" (Zarafa WebApp) nicht ausreichend restriktiv genug sind. Damit kann ein lokaler Angreifer lesend auf temporär gespeicherte Session-Daten von Zarafa WebAccess und Zarafa WebApp, wie z.B. von Benutzern hochgeladene Dateianhänge für E-Mails, zugreifen. Nachfolgend das Security Advisory in englischer Sprache:

Background

Zarafa is a leading European provider of open source groupware and collaboration software. The core product is the Zarafa Collaboration Platform (ZCP), an European open and compatible groupware platform that can be used as a drop-in Microsoft Exchange replacement for e-mail, calendaring, collaboration and tasks (origin: Zarafa company profile).

Description

For accessing e-mails, calendars, contacts and tasks of the groupware platform via the web, Zarafa provides the Zarafa WebAccess and the Zarafa WebApp as clients/frontends. The Zarafa WebApp is a fork and the successor of the Zarafa WebAccess. Both web clients/frontends have on server-side temporary directories which contain PHP session data such as by Zarafa users uploaded e-mail attachments. But the default permissions of these temporary directories are world-readable, thus a local attacker could access these files read-only.

CVSS v2 metrics

Analysis

There is no exploitation which would allow unauthenticated remote attackers to gain root access. However, depending on the gained content of the read-only accessible temporary data, information leaks or further attacks might be possible. The exact path names of the temporary directories changed over the time and releases.

Reproducability

Even the following commands could be used to actively exploit and abuse this flaw they are only made public to analyze if the system in question is vulnerable or not.

robert@tux:~ > id
uid=1000(robert) gid=100(users) groups=100(users) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
robert@tux:~ >

A system with Zarafa WebAccess is affected if the following command can be run as non-privileged system user without any permission error and the temporary directory itself has world readable permissions.

robert@tux:~ > ls -la /var/lib/zarafa-webaccess/tmp/
total 36
drwxr-xr-x. 4 apache apache 4096 Sep 3 10:22 .
drwxr-xr-x. 4 root root 4096 Sep 3 10:22 ..
drwxr-xr-x. 3 apache apache 4096 Sep 8 22:03 attachments
drwxr-xr-x. 2 apache apache 20480 Sep 8 22:10 session
robert@tux:~ >

When using Zarafa WebApp rather Zarafa WebAccess the following command can be used. The system is affected if the temporary directory itself has world readable permissions.

robert@tux:~ > ls -la /var/lib/zarafa-webapp/tmp/
total 16
drwxr-xr-x. 4 apache apache 4096 Sep 3 10:57 .
drwxr-xr-x. 3 root root 4096 Sep 3 10:57 ..
drwxr-xr-x. 2 apache apache 4096 Sep 12 13:40 attachments
drwxr-xr-x. 2 apache apache 4096 Sep 12 13:40 session
robert@tux:~ >

Workaround

Until a fixed version of the Zarafa WebAccess is available (or for a system where a possible future update can not be applied for different reasons) the following commands can be used to correct the wrong permissions.

tux:~ # chown root /var/lib/zarafa-webaccess/tmp/
tux:~ # chmod 770 /var/lib/zarafa-webaccess/tmp/
tux:~ #

When using Zarafa WebApp rather Zarafa WebAccess the following commands can be used to correct the wrong permissions.

tux:~ # chown root /var/lib/zarafa-webapp/tmp/
tux:~ # chmod 770 /var/lib/zarafa-webapp/tmp/
tux:~ #

Both command sections above are however only treated as a workaround because a possible non-fixed intermediate update of Zarafa WebAccess or Zarafa WebApp might revert these manually corrected permissions again.

Affected versions

Fixed versions

CVE information

The MITRE Corporation Common Vulnerabilities and Exposures (CVE) number CVE-2014-5449 was assigned on August 25, 2014. Currently, the following other identifications are known for this issue:

Disclosure timeline

Credit

This vulnerability was discovered, analyzed and reported by Robert Scheck.

Legal notices

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an as is condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.