Bugzilla – Bug 1150532
AUDIT-1: apt-cacher-ng: review of cron job file(s): /etc/cron.daily/apt-cacher-ng
Last modified: 2020-01-30 09:55:19 UTC
+++ This bug was initially created as a clone of Bug #1150175
As discussed in the proactive security team we want to restrict the
installation of cron job files in the future. To achieve this we first need to
cover the currently existing packages that do this.
apt-cacher-ng is installing a cron job in /etc/cron.daily/apt-cacher-ng that
should be reviewed and subsequently whitelisted if all is well.
This cron job triggers a "maintenance task" at the apt-cacher-ng daemon. This
is basically done by talking to localhost:3142 via TCP and trigger a certain
GET operation. If any credentials are required then those are read from
configuration and passed to the HTTP socket.
The cron job script itself looks okay, the localhost communication should also
be fine. It's unencrypted so if anybody should have the possibility to listen
in e.g. via tcpdump then those credentials could leak. But that is not the
case for regular users by default.
On second thought: localhost port 3142 is unprivileged and thus a local user
could fire up a fake server. The acngtool only wants to trigger something at
the server but to do so generic HTTP processing is involved. This HTTP
processing is done with seemingly custom HTTP handling code in
source/dlcon.cc. It also supports HTTP chunked encoding which has been a
source of security issues in other packages in the past. A first look into the
handling of this looks okay in the code.
mchandras left the company. Adding mpluskal as the new maintainer of
apt-cacher-ng according to OBS.
Since there's no maintainer left for apt-cacher-ng I've filed a delete request for the package in Factory. This delete request got accepted by now. I'm decoupling this bug from the CVE sub-bugs. For the CVE I've submitted maintenance update for Leap myself.
Therefore no whitelisting for apt-cacher-ng regarding the cron job is necessary. Closing this bug as WONTFIX.