oss-security - CVE Request (syslog-ng)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1815948490.298961226956228240.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 17 Nov 2008 16:10:28 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: coley@...re.org
Subject: CVE Request (syslog-ng)

Hi Steve,

I'm pretty sure this one deserves a CVE id.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791

syslog-ng doesn't call chdir() before calling chroot().  The chroot(2) man page is
quite clear that if you don't call chdir() first, the process will inherit a '.'
that is outside of the chroot.

By itself this isn't really a flaw (you'll need some other exploit to even attempt to break out of the chroot), and chroot can be broken out of various other ways.
Typically chroot() should not be considered secure, but I suspect this should
probably get an ID if for no other reason than avoiding future confusion.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.