Date: Tue, 17 Jun 2014 13:27:51 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com, Graham Dumpleton <graham.dumpleton@...il.com> Subject: Re: Security release for mod_wsgi (version 3.5) On Wed, 21 May 2014 11:46:32 +0200 Kurt Seifried wrote: > So CVEs were assigned, this is now public, very well written an > detailed write up is at: > > http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html ... > Issue: Possibility of local privilege escalation when using daemon > mode. (CVE-2014-0240) > > The issue is believed to affect Linux systems running kernel versions > > = 2.6.0 and < 3.1.0. > > The issue affects all versions of mod_wsgi up to and including version > 3.4. > > The source of the issue derives from mod_wsgi not correctly handling > Linux specific error codes from setuid(), which differ to what would > be expected to be returned by UNIX systems conforming to the Open > Group UNIX specification for setuid(). Looking at the patch, mod_wsgi was previously expecting that setuid may return error, it only failed to respond to the failure correctly. It only logged information about the failure, and continued to run with unexpected privileges. Few lines above the patched code, the same pattern is used for setgid and setgroups / initgroups calls. Is there a reason to not patch those in the same way? While there may be no such easy way to trigger failure for those, their failure would also lead to user code running with unexpected privileges. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ