oss-security - Re: CVE request: oping allows the disclosure of arbitrary file contents

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 15 Oct 2009 16:44:49 +0200
From: Julien Tinnes <julien.tinnes@...il.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: oping allows the disclosure of 
	arbitrary file contents

On Thu, Oct 15, 2009 at 4:34 PM, Josh Bressers <bressers@...hat.com> wrote:
> ----- "Julien Tinnes" <jt@....org> wrote:
>>
>> in case anyone cares, oping also attempts to drop privileges with
>> setuid(getuid()); without checking setuid()'s return value.
>>
>> It's an obvious vulnerability, because a local attacker can make
>> setuid() fail by setting a resource limit of 0 for RLIMIT_NPROC with
>> setrlimit().
>>
>
> Does that have any security implications though? I've not looked at the app.
> If it's a security problem, I'll give it a CVE id.

I didn't really look either. Because of this, everything will run as
root while it shouldn't, but an attacker might need a second bug to
elevate privileges.
I would still consider it a security problem.

Julien

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.