[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140617154606.39e9f085@redhat.com>
Date: Tue, 17 Jun 2014 15:46:06 +0200
From: Tomas Hoger <thoger@...hat.com>
To: graham.dumpleton@...il.com
Cc: oss-security@...ts.openwall.com
Subject: Re: Security release for mod_wsgi (version 3.5)
On Tue, 17 Jun 2014 22:39:49 +1000 Graham Dumpleton wrote:
> So just to be safe one could in all cases exit anyway, but I believe
> the possibility that these could cause an issue is extremely limited,
> with the only case being where the user provides a bad gid for #nnn
> to the 'group' option which did actually exceed some integer range
> which was actually enforced by the operating system being used. If
> they used an actual group name, which would be the typical case, they
> shouldn't be able to trigger a problem.
My concern was more about things that are outside your control and can
still cause set*id calls to fail even if you feed them with sane data.
Some of these include other errors that can be encountered inside
syscall (e.g. memory allocation issues), capability issues, or simply
having MAC system (think SELinux) policy denying id change. Those were
mentioned here:
http://www.openwall.com/lists/oss-security/2011/08/11/6
http://www.openwall.com/lists/oss-security/2011/08/11/9
Of course, while none of these are known to offer such easily and widely
usable attack vector as RLIMIT_NPROC causing setuid failure, it seems
reasonable to fix all properly while at it.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
