Package: ucarp
Version: 1.5.2-1+nmu1
Severity: normal
hi,
first of all, thank you for your work on packaging ucarp for debian …
while playing around with ucarp, i came across a little issue: in its default
configuration, the shared password used by ucarp is visible to any logged in
user via a simple ps aux | grep carp . a potential attacker could use this
knowledge to conduct a denial of service, although such an attack is rather
unlikely in any real-world scenario.
the attached patch to /etc/network/if-up.d/ucarp adds a "ucarp-passfile"-
configurable option, which makes it possible to use ucarps passfile-option
and works as expected here.
with kind regards,
thoralf.
ps.: please disregard the other bugreport, i thought i had used --debug :-(
-- System Information:
Debian Release: 7.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages ucarp depends on:
ii ifupdown 0.7.8
ii libc6 2.13-38
ii libpcap0.8 1.3.0-1
Versions of packages ucarp recommends:
ii iproute 20120521-3+b3
ucarp suggests no packages.
-- Configuration Files:
/etc/network/if-up.d/ucarp changed [not included]
-- no debconf information
--- /etc/network/if-up.d/ucarp.dpkg 2013-06-11 17:57:39.517127680 +0200
+++ /etc/network/if-up.d/ucarp 2013-06-11 18:27:04.352163592 +0200
@@ -2,6 +2,7 @@
UCARP=/usr/sbin/ucarp
EXTRA_PARAMS=""
+PASS=""
if [ ! -x $UCARP ]; then
exit 0
@@ -43,11 +44,20 @@
EXTRA_PARAMS="$EXTRA_PARAMS -x $IF_UCARP_XPARAM"
fi
-if [ -n "$IF_UCARP_VID" -a -n "$IF_UCARP_VIP" -a \
- -n "$IF_UCARP_PASSWORD" ]; then
- $UCARP -i $IFACE -s $IF_ADDRESS -B -z -v $IF_UCARP_VID \
- -p $IF_UCARP_PASSWORD -a $IF_UCARP_VIP -u $IF_UCARP_UPSCRIPT \
- -d $IF_UCARP_DOWNSCRIPT $EXTRA_PARAMS
+if [ -n "$IF_UCARP_PASSWORD" ]; then
+ EXTRA_PARAMS="$EXTRA_PARAMS -p $IF_UCARP_PASSWORD"
+ PASS=yes
+fi
+
+if [ -n "$IF_UCARP_PASSFILE" ]; then
+ EXTRA_PARAMS="$EXTRA_PARAMS -o $IF_UCARP_PASSFILE"
+ PASS=yes
+fi
+
+
+if [ -n "$IF_UCARP_VID" -a -n "$IF_UCARP_VIP" -a -n "$PASS" ]; then
+ $UCARP -i $IFACE -s $IF_ADDRESS -B -z -v $IF_UCARP_VID -a $IF_UCARP_VIP \
+ -u $IF_UCARP_UPSCRIPT -d $IF_UCARP_DOWNSCRIPT $EXTRA_PARAMS
fi
# vi:ai sw=4 ts=4 tw=0 et
