oss-security - Multiple libraries privilege checking

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 16 May 2011 16:27:41 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Multiple libraries privilege checking

Hi,

Its probably about time to review libraries that are commonly
linked to (formerly-) suid programs, such as
libldap, libssl etc. In near future, in the advent of file caps
they are often lacking proper checks.
They usually just compare uid against euid (not even gid sometimes)
and do not check the dumpable flag or AT_SECURE (dont know whether
glibc exports a proper function to easily check that at all).

The libraries that I had a quick look at and which were found
"vulnerable" are:

- openssl-1.0.0c
- openldap-2.4.23
- cyrus-sasl-2.1.23

which is probably far from complete. Even if not linked directly to
a privileged running program, these libraries may be introduced by
plugins or frameworks (pam etc).
As a result, attackers may specify plugin directories or rouge directory
services for authentication as these libraries think they are
running unprivileged.
So better to fix them now than to be sorry in one year when they are going
to be used the fscaps-way.

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team

---
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.