[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87oawxuh79.fsf@mid.deneb.enyo.de>
Date: Thu, 10 Jul 2014 21:50:02 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-0475: glibc directory traversal in LC_* locale handling
* Solar Designer:
> The default sshd_config found in openssh-6.6p1.tar.gz does not list
> AcceptEnv, so presumably by default OpenSSH portable does not accept any
> environment variables.
I expected it to accept TERM, which is sort of unavoidable.
> However, apparently some distros override this safe default:
Yes, indeed. There is clear user demand for this, especially from
organizations like Debian which have users in many different locales.
> Is there a supported way for distros to configure OpenSSH such that
> a number of environment variables would be accepted by default, but
> only as long as no command is forced? This could be an acceptable
> tradeoff.
It is already possible to emulate this behavior with Match directives,
so this is probably not sufficient reason for OpenSSH changes.
However, on systems which follow POSIX strictly and do not share the
historic glibc bug, the glibc fix is does not apply, so some OpenSSH
changes to better support them might be necessary.
On the other hand, as long as you use a general-purpose, shell-backed
SSH implementation such as OpenSSH, it is difficult to completely rule
out code execution by proper configuration. But the library-based SSH
implementations are likely less mature protocol-wise than OpenSSH,
unfortunately.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
