From: git@ipfire.org
To: ipfire-scm@lists.ipfire.org
Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. a9a91e5fa713c14f59d20228c228f0e67c4365a8
Date: Wed, 14 Jun 2017 13:04:19 +0100 [thread overview]
Message-ID: <20170614120420.0F96F1078E83@git01.ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 8376 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via a9a91e5fa713c14f59d20228c228f0e67c4365a8 (commit)
from 65ca3f05075a11e2bce7daef5980f9bb4715ae84 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit a9a91e5fa713c14f59d20228c228f0e67c4365a8
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Wed Jun 14 12:58:12 2017 +0100
ids.cgi: Fix remote command execution vulnerability
The OINKCODE variable was only validated for proper input
when the Save button was clicked.
Did the user demand to download new rules instead, the
content of that variable was not being validated (again)
and was passed to wget on the shell.
This was done with privileges of the "nobody" user.
Fixes #11401
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
html/cgi-bin/ids.cgi | 149 +++++++++++++++++++++++++--------------------------
1 file changed, 72 insertions(+), 77 deletions(-)
Difference in files:
diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index fbd1f13..3d95197 100644
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -253,99 +253,94 @@ if (-e "/etc/snort/snort.conf") {
####################### End added for snort rules control #################################
-if ($snortsettings{'RULES'} eq 'subscripted') {
- $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snortsettings{'OINKCODE'}";
-} elsif ($snortsettings{'RULES'} eq 'registered') {
- $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snortsettings{'OINKCODE'}";
-} elsif ($snortsettings{'RULES'} eq 'community') {
- $url=" https://www.snort.org/rules/community";
-} else {
- $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz";
+if ($snortsettings{'OINKCODE'} ne "") {
+ $errormessage = $Lang::tr{'invalid input for oink code'} unless ($snortsettings{'OINKCODE'} =~ /^[a-z0-9]+$/);
}
-if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" )
-{
- $errormessage = $Lang::tr{'invalid input for oink code'} unless (
- ($snortsettings{'OINKCODE'} =~ /^[a-z0-9]+$/) ||
- ($snortsettings{'RULES'} eq 'nothing' ) ||
- ($snortsettings{'RULES'} eq 'emerging' ) ||
- ($snortsettings{'RULES'} eq 'community' ));
-
- &General::writehash("${General::swroot}/snort/settings", \%snortsettings);
- if ($snortsettings{'ENABLE_SNORT'} eq 'on')
- {
- system ('/usr/bin/touch', "${General::swroot}/snort/enable");
+if (!$errormessage) {
+ if ($snortsettings{'RULES'} eq 'subscripted') {
+ $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snortsettings{'OINKCODE'}";
+ } elsif ($snortsettings{'RULES'} eq 'registered') {
+ $url=" https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=$snortsettings{'OINKCODE'}";
+ } elsif ($snortsettings{'RULES'} eq 'community') {
+ $url=" https://www.snort.org/rules/community";
} else {
- unlink "${General::swroot}/snort/enable";
- }
- if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on')
- {
- system ('/usr/bin/touch', "${General::swroot}/snort/enable_green");
- } else {
- unlink "${General::swroot}/snort/enable_green";
- }
- if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on')
- {
- system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue");
- } else {
- unlink "${General::swroot}/snort/enable_blue";
- }
- if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on')
- {
- system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange");
- } else {
- unlink "${General::swroot}/snort/enable_orange";
- }
- if ($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'on')
- {
- system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect");
- } else {
- unlink "${General::swroot}/snort/enable_preprocessor_http_inspect";
+ $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz";
}
- system('/usr/local/bin/snortctrl restart >/dev/null');
+ if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) {
+ &General::writehash("${General::swroot}/snort/settings", \%snortsettings);
+ if ($snortsettings{'ENABLE_SNORT'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable");
+ } else {
+ unlink "${General::swroot}/snort/enable";
+ }
+ if ($snortsettings{'ENABLE_SNORT_GREEN'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable_green");
+ } else {
+ unlink "${General::swroot}/snort/enable_green";
+ }
+ if ($snortsettings{'ENABLE_SNORT_BLUE'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable_blue");
+ } else {
+ unlink "${General::swroot}/snort/enable_blue";
+ }
+ if ($snortsettings{'ENABLE_SNORT_ORANGE'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable_orange");
+ } else {
+ unlink "${General::swroot}/snort/enable_orange";
+ }
+ if ($snortsettings{'ENABLE_PREPROCESSOR_HTTP_INSPECT'} eq 'on')
+ {
+ system ('/usr/bin/touch', "${General::swroot}/snort/enable_preprocessor_http_inspect");
+ } else {
+ unlink "${General::swroot}/snort/enable_preprocessor_http_inspect";
+ }
-}
+ system('/usr/local/bin/snortctrl restart >/dev/null');
+ }
- # INSTALLMD5 is not in the form, so not retrieved by getcgihash
+ # INSTALLMD5 is not in the form, so not retrieved by getcgihash
&General::readhash("${General::swroot}/snort/settings", \%snortsettings);
-if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) {
-
- my @df = `/bin/df -B M /var`;
- foreach my $line (@df) {
- next if $line =~ m/^Filesystem/;
- my $return;
-
- if ($line =~ m/dev/ ) {
- $line =~ m/^.* (\d+)M.*$/;
- my @temp = split(/ +/,$line);
- if ($1<300) {
- $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB";
- } else {
-
- if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} ){
-
- &downloadrulesfile();
- sleep(3);
- $return = `cat /var/tmp/log 2>/dev/null`;
-
- } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'} ) {
- my $upload = $a->param("UPLOAD");
- open UPLOADFILE, ">/var/tmp/snortrules.tar.gz";
- binmode $upload;
- while ( <$upload> ) {
- print UPLOADFILE;
+ if ($snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'} || $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) {
+ my @df = `/bin/df -B M /var`;
+ foreach my $line (@df) {
+ next if $line =~ m/^Filesystem/;
+ my $return;
+
+ if ($line =~ m/dev/ ) {
+ $line =~ m/^.* (\d+)M.*$/;
+ my @temp = split(/ +/,$line);
+ if ($1<300) {
+ $errormessage = "$Lang::tr{'not enough disk space'} < 300MB, /var $1MB";
+ } else {
+ if ( $snortsettings{'ACTION'} eq $Lang::tr{'download new ruleset'}) {
+ &downloadrulesfile();
+ sleep(3);
+ $return = `cat /var/tmp/log 2>/dev/null`;
+
+ } elsif ( $snortsettings{'ACTION'} eq $Lang::tr{'upload new ruleset'}) {
+ my $upload = $a->param("UPLOAD");
+ open UPLOADFILE, ">/var/tmp/snortrules.tar.gz";
+ binmode $upload;
+ while ( <$upload> ) {
+ print UPLOADFILE;
+ }
+ close UPLOADFILE;
}
- close UPLOADFILE;
- }
- if ($return =~ "ERROR"){
+ if ($return =~ "ERROR") {
$errormessage = "<br /><pre>".$return."</pre>";
} else {
system("/usr/local/bin/oinkmaster.pl -v -s -u file:///var/tmp/snortrules.tar.gz -C /var/ipfire/snort/oinkmaster.conf -o /etc/snort/rules >>/var/tmp/log 2>&1 &");
sleep(2);
}
+ }
}
}
}
hooks/post-receive
--
IPFire 2.x development tree
reply other threads:[~2017-06-14 12:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170614120420.0F96F1078E83@git01.ipfire.org \
--to=git@ipfire.org \
--cc=ipfire-scm@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox