Date: Fri, 25 May 2012 00:10:04 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE Request: powerdns does not clear supplementary groups Kurt - On Thu, May 24, 2012 at 12:40:10PM -0600, Kurt Seifried wrote: > Supplemental groups enabled a user to be a member of more than one > group at a time (us old timers remember the joys of "newgrp"). Why > would anyone want this? You could for example create a group that has > permissions to access logging, terminals (e.g. modems, remember those? > =) and then add users to it as appropriate (and centralize > account/permissions management somewhat and all that good stuff). That's what initgroups(3) is for. If a program that is supposed to drop privs calls neither setgroups() nor initgroups(), or if it fails to check the return value from these and refuse to proceed on failure, then it is vulnerable. > So what happens when a program starts running as say root, and root > has supplemental groups (like "bin" or "daemon" and the program drops > its primary user/group but fails to drop supplementary groups, is that > a security issue, Definitely. > and is it worthy of a CVE identifier? It should be. > Having supplementary groups is intentional [...] Having supplementary groups of the new (pseudo-)user, possibly yes. Having supplementary groups of the old switched-from user, no. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.