[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201106091104.03473.ludwig.nussel@suse.de>
Date: Thu, 9 Jun 2011 11:04:03 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Cc: Russell Coker <rcoker@...hat.com>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
Josh Bressers wrote:
> > I, for instance, use su -u to run commands as the www user, what are
> > the odds of that user being compromised without my knowledge? The last
> > thing I want is having a way for that compromised user to run
> > arbitrary commands as any other user.
>
> This is unsafe, I'm not even sure if it can be made safe honestly (without
> breaking lots of things that expect tty access). Things like su and sudo
> are designed to raise privileges, not lower them. If this isn't well
> documented, it should be.
Note that you already have the setsid() patch in Fedora since 2005
so it actually didn't break that much I guess :-) You also have the
runuser program with is basically su without authentication. runuser
is specifically intended for use by root to run programs as
unprivileged user.
FWIW I've found ikiwiki-mass-rebuild to be vulnerable to the tty
hijacking issue too. Upstream was rather quick to switch to using
su¹ now. ikiwiki-mass-rebuild is also intended to be called in
package post scripts. I wouldn't be surprised if there are other
packages that run su to perform some operation as unprivileged user
in %post.
So we would like to release a coreutils security update which adds
the setsid patch.
cu
Ludwig
[1] http://ikiwiki.info/news/version_3.20110608/
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
