An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Trousers | Trousers_project | * | 0.3.14 (including) |
| Red Hat Enterprise Linux 8 | RedHat | trousers-0:0.3.15-1.el8 | * |
| Trousers | Ubuntu | bionic | * |
| Trousers | Ubuntu | focal | * |
| Trousers | Ubuntu | groovy | * |
| Trousers | Ubuntu | hirsute | * |
| Trousers | Ubuntu | impish | * |
| Trousers | Ubuntu | kinetic | * |
| Trousers | Ubuntu | trusty | * |
| Trousers | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html
References
- http://www.openwall.com/lists/oss-security/2020/08/14/1
- https://bugzilla.suse.com/show_bug.cgi?id=1164472
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
- https://sourceforge.net/p/trousers/mailman/message/37015817/
- http://www.openwall.com/lists/oss-security/2020/08/14/1
- https://bugzilla.suse.com/show_bug.cgi?id=1164472
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/
- https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch
- https://sourceforge.net/p/trousers/mailman/message/37015817/