[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150213070505.GC23507@brightrain.aerifal.cx>
Date: Fri, 13 Feb 2015 02:05:05 -0500
From: Rich Felker <dalias@...c.org>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: CVE request: sudo TZ issue
On Wed, Feb 11, 2015 at 10:20:03AM -0700, Todd C. Miller wrote:
> > Depending on how other code is written, a TZ value could still be
> > malicious even if it doesn't satisfy the definition of "unsafe" that
> > you included. Should there be other CVEs for sudo if any such code is
> > identified?
>
> There are really two issues here: exposure of TZ parsing bugs and
> access to arbitrary (potentially user-controlled) files. I'm happy
> to put the blame for TZ parsing bugs on libc or the application.
> However, there is no real way for the application to tell that it
> is being run by an unpriviliged user and that operations that would
> otherwise be safe (opening a user-specified time zone file) may be
> dangerous.
Why does sudo run the target program with both effective and real ids
set to root? Why not run with only the effective uid set to root? Then
the program would know that it's being run by an unprivileged user
with elevated privileges (and its libc would restrict or ignore
environment variables for internal libc use). Does such invocation
break too many programs?
Rich
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
