Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 31 May 2011 10:21:33 +0200
From: Sebastian Krahmer <>
Subject: CVE request: multiple libraries getenv() misuse


While investigating the libs vs. fscaps issue [1] which showed
that most libs need patching in order to work properly with fscaps
binaries, it was also found that a lot of libs do not even honour
suid binaries correctly. These libs use getenv() to obtain information
about configuration/files or plugin directories. These info can be
"chosen with care" by attackers to trick the suid programs to execute
code as root or do harm otherwise.
Among these libs are libudev, libdbus, libhal, libgssglue or libcrypto
(openssl). libudev, libdbus, libhal are linked against suid Xorg.
libgssglue is linked against mount.nfs.
Most of these libs were probably never intented to be linked against
suids, but nevertheless they are.

Since the issues are all of the same family I would suggest to assign
one CVE (or two, if you want to separate missing fscaps checks from
euid != uid issue).




~ perl
~ $_='print"\$_=\47$_\47;eval"';eval
~ - SuSE Security Team

SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.