oss-security - tftpd-hpa - insecure chroot()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171102121654.GA5905@gremlin.ru>
Date: Thu, 2 Nov 2017 15:16:55 +0300
From: gremlin@...mlin.ru
To: oss-security@...ts.openwall.com
Subject: tftpd-hpa - insecure chroot()

Just look at this code and guess how it would be compiled on most
systems:

========================================
    /* Chroot and drop privileges */
    if (secure) {
        if (chroot(".")) {
            syslog(LOG_ERR, "chroot: %m");
            exit(EX_OSERR);
        }
#ifdef __CYGWIN__
        chdir("/");             /* Cygwin chroot() bug workaround */
#endif
    }
========================================

:-)


-- 
Alexey V. Vissarionov aka Gremlin from Kremlin
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8

Content of type "application/pgp-signature" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.