Date: Wed, 8 Jun 2011 14:11:21 -0400 (EDT) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: Russell Coker <rcoker@...hat.com>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl ----- Original Message ----- > > I failed to see why setsid() doesn't prevent the priviledges > escalation. AFAIU the exploit is only possible if the process has a > controlling tty, which is prevented by setsid() It may prevent it for one condition, but not others. For example if I su to a normal user (not -c), I can keep the tty open. My point is it's not safe to do this. > > >I would classify this as an administration issue, not a flaw in su or > >sudo. If you're running arbitrary things, you're in far more trouble > >than this. > > Well, you're not running arbitrary things, you're running commands as > a less priviledged user under the assumption that it will be > restricted to that user. > > The scenario of having this less priviledged user compromised without > admin knowledge is not far from real. > > I, for instance, use su -u to run commands as the www user, what are > the odds of that user being compromised without my knowledge? The last > thing I want is having a way for that compromised user to run > arbitrary commands as any other user. > This is unsafe, I'm not even sure if it can be made safe honestly (without breaking lots of things that expect tty access). Things like su and sudo are designed to raise privileges, not lower them. If this isn't well documented, it should be. In your situation, I would suggest using something like ssh with key authentication setup. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.