[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120524201004.GA3940@openwall.com>
Date: Fri, 25 May 2012 00:10:04 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: powerdns does not clear supplementary groups
Kurt -
On Thu, May 24, 2012 at 12:40:10PM -0600, Kurt Seifried wrote:
> Supplemental groups enabled a user to be a member of more than one
> group at a time (us old timers remember the joys of "newgrp"). Why
> would anyone want this? You could for example create a group that has
> permissions to access logging, terminals (e.g. modems, remember those?
> =) and then add users to it as appropriate (and centralize
> account/permissions management somewhat and all that good stuff).
That's what initgroups(3) is for. If a program that is supposed to drop
privs calls neither setgroups() nor initgroups(), or if it fails to
check the return value from these and refuse to proceed on failure, then
it is vulnerable.
> So what happens when a program starts running as say root, and root
> has supplemental groups (like "bin" or "daemon" and the program drops
> its primary user/group but fails to drop supplementary groups, is that
> a security issue,
Definitely.
> and is it worthy of a CVE identifier?
It should be.
> Having supplementary groups is intentional [...]
Having supplementary groups of the new (pseudo-)user, possibly yes.
Having supplementary groups of the old switched-from user, no.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
