PacketFence - BTS - PacketFence
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0001087PacketFencescanningpublic2010-10-08 14:562011-10-24 20:24
Reporterobilodeau 
Assigned Toobilodeau 
PriorityhighSeveritymajorReproducibilitysometimes
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target Version3.0.0Fixed in Version3.0.0 
fixed in git revision
fixed in mtn revisionfd18daff77b97ab16edef499a8d0751cce5b54de
Summary0001087: nessus scans don't work with bin/pfcmd setuid/setgid (which is the default)
Descriptiondoing stuff in the lab, we came up to this problem..

Here's the error:
-sh-3.2$ /usr/local/pf/bin/pfcmd schedule now 192.168.2.253
Insecure dependency in open while running setgid at
        /usr/local/pf/lib/pf/scan.pm line 77 (0000001)
    (F) You tried to do something that the tainting mechanism didn't like.
    The tainting mechanism is turned on when you're running setuid or
    setgid, or when you specify -T to turn it on explicitly. The
    tainting mechanism labels all data that's derived directly or indirectly
    from the user, who is considered to be unworthy of your trust. If any
    such data is used in a "dangerous" operation, you get this error. See
    perlsec for more information.

Uncaught exception from user code:
        Insecure dependency in open while running setgid at /usr/local/pf/lib/pf/scan.pm line 77.
 at /usr/local/pf/lib/pf/scan.pm line 77
        pf::scan::runScan(192.168.2.253) called at /usr/local/pf/bin/pfcmd line 1367
        main::schedule() called at /usr/local/pf/bin/pfcmd line 247

Possible fixes:
- untaint / laundry variables to make perl happy
- have a separate CLI for it which doesn't require setuid/setgid
- re-architect the whole thing to drop setuid/setgid requirements
- sudo profiles?
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
related to 0001025closed obilodeau check if bin/pfcmd is setuid on sanity_check 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2010-10-08 14:56obilodeauNew Issue
2010-11-15 13:38obilodeauRelationship addedrelated to 0001116
2011-01-18 11:41obilodeauTarget Version => 2.1.0
2011-02-25 13:40obilodeauRelationship addedrelated to 0001025
2011-02-25 13:54obilodeauNote Added: 0001885
2011-03-03 15:15obilodeauTarget Version2.1.0 => +1
2011-03-03 15:18obilodeauTarget Version+1 => +2
2011-03-03 15:42obilodeauAssigned To => obilodeau
2011-03-03 15:42obilodeauSeverityminor => major
2011-03-03 15:42obilodeauStatusnew => confirmed
2011-03-03 15:42obilodeauTarget Version+2 => +1
2011-06-17 17:26obilodeauDescription Updated
2011-06-17 17:49obilodeaumtn revision => fd18daff77b97ab16edef499a8d0751cce5b54de
2011-06-17 17:49obilodeauNote Added: 0002092
2011-06-17 17:49obilodeauStatusconfirmed => resolved
2011-06-17 17:49obilodeauFixed in Version => +1
2011-06-17 17:49obilodeauResolutionopen => fixed
2011-06-17 17:49obilodeauNote Added: 0002093
2011-09-21 22:20obilodeauFixed in Version+1 => 3.0.0
2011-09-21 22:20obilodeauNote Added: 0002278
2011-09-21 22:21obilodeauStatusresolved => closed
2011-10-24 20:24obilodeauTarget Version+1 => 3.0.0

Notes
(0001885)
obilodeau   
2011-02-25 13:54   
remember to increase warning level to FATAL in pf::pfcmd::checkup::permissions() once this is fixed
(0002092)
obilodeau   
2011-06-17 17:49   
fixed by sanitizing / untainting the data in the path to a nessus scan
(0002093)
obilodeau   
2011-06-17 17:49   
Reminder sent to: fgaudreault

You'll probably be glad to hear that this one is fixed.
(0002278)
obilodeau   
2011-09-21 22:20   
fix released in 3.0