[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Aug 2011 23:33:04 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: csmall@...ian.org
Subject: CVE request (and disclosure): ax25d missing setuid return code check
The AX.25 daemon (ax25d), typically provided in the ax25-tools
package, allows administrators to associate incoming AX.25, NET/ROM,
and ROSE traffic with the execution of an endpoint program (most
commonly "node"), which is run under a specified user account.
Because ax25d is missing a check on the return code for a setuid call
responsible for dropping privileges to the specified user, it may be
possible to cause setuid to fail, after which the chosen program will
be executed with root privileges. In other words, if you're in the
business of handing out unprivileged shells over amateur radio (don't
we all? :p ), this would allow for remote compromise.
-Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
