Insecure Permissions in xfsdump Package Leading to Potential File Overwrites
Summary
DEBIAN-CVE-2007-2654: xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems. Affects xfsdump versions < 2.2.45-1. Fixed in 2.2.45-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xfsdump package is a utility for backing up and restoring XFS filesystems. It is designed to efficiently manage the storage and retrieval of data on XFS, a high-performance filesystem used in many Linux environments. However, a vulnerability has been identified in the way xfsdump handles temporary directories, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2007-2654, arises from the xfs_fsr function within the xfsdump package. This function creates a temporary directory named .fsr with insecure permissions, allowing local users to read or overwrite arbitrary files on XFS filesystems. This could lead to unauthorized access to sensitive data or disruption of services, making it critical to address this issue promptly.
How To Fix
Minimum fixed version
2.2.45-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xfsdumpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the .fsr directory after it is created, although this is not a recommended long-term solution. The command to change permissions is: chmod 700 .fsr. However, the best practice is to update the package to the fixed version.
Conclusion
The xfsdump package has a vulnerability that can lead to insecure permissions on temporary directories, allowing local users to access or overwrite files. It is crucial to update to the latest patched version to secure your system against potential threats.
See every vulnerability recorded for xfsdump →
FAQ
xfsdump is a utility for backing up and restoring data on XFS filesystems, providing efficient data management.
The risks include unauthorized access to sensitive files and potential data loss due to overwriting of files by local users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, a patched version of the xfsdump package (2.2.45-1) is available. Users should update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider changing the permissions of the .fsr directory as a temporary workaround, but prioritize updating as soon as feasible.
References
Related vulnerabilities
Recent vulnerabilities recorded for xfsdump.
