Date: Mon, 16 May 2011 16:27:41 +0200 From: Sebastian Krahmer <krahmer@...e.de> To: oss-security@...ts.openwall.com Subject: Multiple libraries privilege checking Hi, Its probably about time to review libraries that are commonly linked to (formerly-) suid programs, such as libldap, libssl etc. In near future, in the advent of file caps they are often lacking proper checks. They usually just compare uid against euid (not even gid sometimes) and do not check the dumpable flag or AT_SECURE (dont know whether glibc exports a proper function to easily check that at all). The libraries that I had a quick look at and which were found "vulnerable" are: - openssl-1.0.0c - openldap-2.4.23 - cyrus-sasl-2.1.23 which is probably far from complete. Even if not linked directly to a privileged running program, these libraries may be introduced by plugins or frameworks (pam etc). As a result, attackers may specify plugin directories or rouge directory services for authentication as these libraries think they are running unprivileged. So better to fix them now than to be sorry in one year when they are going to be used the fscaps-way. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.