[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <988082d0-add1-46bf-92ef-bf7d0cdff9a0@email.android.com>
Date: Mon, 06 Jun 2011 16:38:49 -0400
From: "daniel@...so.com" <daniel@...so.com>
To: Josh Bressers <bressers@...hat.com>,oss-security@...ts.openwall.com
CC: Russell Coker <rcoker@...hat.com>,"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
Josh Bressers <bressers@...hat.com> wrote:
>This really shouldn't get a CVE id. It's well known, and sadly, not easy
>to
>fix. There are more details in this bug:
>https://bugzilla.redhat.com/show_bug.cgi?id=479145
I failed to see why setsid() doesn't prevent the priviledges escalation. AFAIU the exploit is only possible if the process has a controlling tty, which is prevented by setsid()
>I would classify this as an administration issue, not a flaw in su or
>sudo.
>If you're running arbitrary things, you're in far more trouble than
>this.
Well, you're not running arbitrary things, you're running commands as a less priviledged user under the assumption that it will be restricted to that user.
The scenario of having this less priviledged user compromised without admin knowledge is not far from real.
I, for instance, use su -u to run commands as the www user, what are the odds of that user being compromised without my knowledge? The last thing I want is having a way for that compromised user to run arbitrary commands as any other user.
Daniel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
