Date: Wed, 27 Jul 2011 05:37:20 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request: multiple libraries getenv() misuse On Tue, May 31, 2011 at 10:21:33AM +0200, Sebastian Krahmer wrote: > While investigating the libs vs. fscaps issue  which showed > that most libs need patching in order to work properly with fscaps > binaries, it was also found that a lot of libs do not even honour > suid binaries correctly. These libs use getenv() to obtain information > about configuration/files or plugin directories. These info can be > "chosen with care" by attackers to trick the suid programs to execute > code as root or do harm otherwise. > Among these libs are libudev, libdbus, libhal, libgssglue or libcrypto > (openssl). libudev, libdbus, libhal are linked against suid Xorg. > libgssglue is linked against mount.nfs. > Most of these libs were probably never intented to be linked against > suids, but nevertheless they are. > > Since the issues are all of the same family I would suggest to assign > one CVE (or two, if you want to separate missing fscaps checks from > euid != uid issue). I think it'd be a good idea to keep track of these issues per-library on the wiki: http://oss-security.openwall.org/wiki/code-reviews >  http://www.suse.de/~krahmer/libs-vs-fscaps/ I got your OpenSSL changes into Owl-current yesterday (except for the changes to OPENSSL_issetugid() itself, which on Owl was already using __libc_enable_secure). The rest of the libraries that you mention are not in Owl. Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.