CVE-2017-7549 instack-undercloud vulnerable to symlink attack on tmp files
A local attacker can exploit insecure temporary files in instack-undercloud scripts to overwrite arbitrary files via symbolic link attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7549?
CVE-2017-7549 is a medium-severity path traversal vulnerability in Red Hat, Inc. instack-undercloud, published on 21 Sep 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
Which versions are affected by CVE-2017-7549?
4 open source packages ship an affected version, including instack-undercloud and instack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
instack-undercloud PyPI | All versions to 7.2.0 | None |
instack-undercloud PyPI | All versions to 7.2.0 | None |
instack-undercloud PyPI | All versions to 7.2.0 | None |
instack PyPI | All versions to 7.2.0 | None |
Linux distribution packages (5)
instack-undercloud Red Hat:openstack-director:7::el7 | All versions | 0:2.1.2-41.el7ost |
instack-undercloud Red Hat:openstack-director:8::el7 | All versions | 0:2.2.7-10.el7ost |
instack-undercloud Red Hat:openstack-director:9::el7 | All versions | 0:4.0.0-17.el7ost |
instack-undercloud Red Hat:openstack:10::el7 | All versions | 0:5.3.0-3.el7ost |
instack-undercloud Red Hat:openstack:11::el7 | All versions | 0:6.1.0-3.el7ost |
Products include Openstack Instack-Undercloud.
How do I fix CVE-2017-7549?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-7549 being exploited?
There is no known exploitation of CVE-2017-7549 in the wild and no public exploit code.
Sources
Also known as GHSA-53wm-97p6-582f, PYSEC-2017-152, PYSEC-2026-645, RHSA-2017:2557, RHSA-2017:2649, RHSA-2017:2687 and 2 more.