oss-security - Re: CVE request: oping allows the disclosure of arbitrary file contents

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 16 Nov 2009 22:51:16 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: jt@....org
Subject: Re: CVE request: oping allows the disclosure of 
 arbitrary file contents

On Thu, 15 Oct 2009 15:15:57 +0200 Julien Tinnes <jt@....org> wrote:

> in case anyone cares, oping also attempts to drop privileges with
> setuid(getuid()); without checking setuid()'s return value.
> 
> It's an obvious vulnerability, because a local attacker can make
> setuid() fail by setting a resource limit of 0 for RLIMIT_NPROC with
> setrlimit().

Does the RLIMIT_NPROC trick work against oping, or any setuid app that
calls setuid(getuid())?

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.