[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0809241419240.16490@faron.mitre.org>
Date: Wed, 24 Sep 2008 14:19:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: kernel: open() call allows setgid
bit when user is not in new file's group
On Wed, 24 Sep 2008, Eugene Teo wrote:
> "When creating a file, open()/creat() allows the setgid bit to be set
> via the mode argument even when, due to the bsdgroups mount option or
> the file being created in a setgid directory, the new file's group is
> one which the user is not a member of. The user can then use
> ftruncate() and memory-mapped I/O to turn the new file into an arbitrary
> binary and thus gain the privileges of this group, since these
> operations do not clear the setgid bit."
Use CVE-2008-4210, to be filled in later.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
