oss-security - Re: CVE request: pam_ssh not dropping root gid(s)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 06 Jun 2011 17:06:40 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Sebastian Krahmer <krahmer@...e.de>
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request: pam_ssh not dropping root gid(s)

Hello, Sebastian,

   thanks for the report.

On 06/06/2011 11:26 AM, Sebastian Krahmer wrote:
> Hi,
>
> In certain configs, pam_ssh is not completely dropping its privileges
> to user. It just forgets to call setgid() and initgroups(). A fix can be found at [1].
> Can someone assign a CVE?
>
> thx,
> Sebastian
>
> [1] https://bugzilla.novell.com/show_bug.cgi?id=665061

Unfortunately not able to access this entry. Would it be possible to 
make it public? (for further details & CVE assignment). Or will be
access granted per email address approach necessary?

Thank you & Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.