[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 26 Sep 2014 14:06:21 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2014-6271: remote code execution through
bash (3rd vulnerability)
On 26/09/14 09:54, Mark R Bannister wrote:
> Patch every OS to clear the environment on setuid/setgid and live
> with a few other programs that might break?
Apache suexec, among other things, can't work if the environment is
cleared. It needs to pass the CGI environment variables through, and is
setuid itself.
Properly-written setuid components are often a necessary part of letting
unprivileged components benefit from privilege-separation (e.g. CGI
scripts running with less privilege than the web server, with neither
running as root). The problem is that not all setuid components are
properly-written.
> Tell everyone to stop using setuid/setgid now and forever?
Minimizing use of setuid/setgid, and making sure the setuid/setgid
things are suitably hardened, is a good idea. However, tools for
controlled privilege escalation (sudo, pkexec, Apache suexec) rely on
setuid in order to work. There's a reason the feature exists at all.
I still think a large part of the answer is "consider it to be a serious
bug when a setuid/setgid tool does non-trivial things without first
filtering its attacker-controlled environment through a whitelist".
If it needs to pass environment variables through to a child, this
pseudocode is a good pattern (AIUI, sudo does this):
let saved_environ = copy of environ
let environ = empty
setenv(PATH = "/usr/bin:/bin") # or some other safe value
setenv(HOME = "/")
# ... and repeat for a few other well-known variables that are
# often relied on
if saved_environ["LANG"] has a safe value {
setenv(LANG = saved_environ["LANG"])
# ... and repeat for a few other well-known variables
# that can safely be passed-through if their values are
# suitably constrained
}
parse options
decide what to do
do PAM authentication/authorization etc.
drop privileges / set up privileges as necessary
if configured to pass environment through {
copy some or all of saved_environ back into environ
}
exec(child, child_args)
Regards,
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
