oss-security - CVE Request (syslog-ng)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 17 Nov 2008 16:10:28 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: coley@...re.org
Subject: CVE Request (syslog-ng)

Hi Steve,

I'm pretty sure this one deserves a CVE id.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791

syslog-ng doesn't call chdir() before calling chroot().  The chroot(2) man page is
quite clear that if you don't call chdir() first, the process will inherit a '.'
that is outside of the chroot.

By itself this isn't really a flaw (you'll need some other exploit to even attempt to break out of the chroot), and chroot can be broken out of various other ways.
Typically chroot() should not be considered secure, but I suspect this should
probably get an ID if for no other reason than avoiding future confusion.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.