Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 17 Nov 2008 16:10:28 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: coley@...re.org
Subject: CVE Request (syslog-ng)

Hi Steve,

I'm pretty sure this one deserves a CVE id.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791

syslog-ng doesn't call chdir() before calling chroot().  The chroot(2) man page is
quite clear that if you don't call chdir() first, the process will inherit a '.'
that is outside of the chroot.

By itself this isn't really a flaw (you'll need some other exploit to even attempt to break out of the chroot), and chroot can be broken out of various other ways.
Typically chroot() should not be considered secure, but I suspect this should
probably get an ID if for no other reason than avoiding future confusion.

Thanks.

-- 
    JB

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ