Date: Mon, 14 Nov 2011 09:15:03 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Did this ArchLinux/shaman thing ever get a CVE? Did this ever get a CVE #? I can't find one. https://bbs.archlinux.org/viewtopic.php?id=64066&p=1 ==================== The point of this thread was that you don't need to enter the root password at all. Not the first time, not ever. As far as I understand, it is supposed to work like this: When you first use shaman too install anything, it asks for the root password You can tick a "Do not ask me again"-box, so you don't have to enter the password again. If you tick the box and enter the password, shaman add the lines [auth] askforpwd=false to the users shaman.conf-file (~./config/shaman/shaman.conf) The next time shaman is run, it checks the config file, and if the askforpwd value is set to false, it grants itself root privileges (with some nifty setuuid root-thingy, I imagine) This is not the problem - this is the feature. The bug is this: the fact that any user can add the lines [auth] askforpwd=false to his own shaman.conf file, without ever entering the root password in shaman. The next time shaman is run, it checks the config file, and if the askforpwd value is set to false, it grants itself root privileges - even though the user has never entered the root password. This works for any unprivileged user on the system. If that is indeed a feature intended by any sane person, then I'm Mother Mary. And that can't be, seeing as I don't have breasts. ==================== Appears to never have been fixed, the last release of shaman appears to have been 1.0.9 in 2008-09-06, the bug report was filed 2009-01-28. -- -Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.