Date: Wed, 11 Jul 2012 17:27:41 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Dustin Kirkland <dustin.kirkland@...zang.com>, Tyler Hicks <tyhicks@...onical.com>, Marcus Meissner <meissner@...e.de>, Dan Rosenberg <dan.j.rosenberg@...il.com> Subject: Re: Re: ecryptfs headsup -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/11/2012 10:48 AM, Kurt Seifried wrote: >> Hi Tyler, et al.- > >> I don't have any objections at all with adding nosuid and nodev >> to the hardcoded mount.ecryptfs_private options. > >> Actually, I seem to recall this coming up recently before. I >> can't find the bug or email thread (must have been IRC), but I >> recall offering to commit, test, and release that change >> immediately. I believe I was asked to wait to do that until a >> CVE had been published... I can't find any record of that >> conversation though, so that's just from memory. > >> Shall I go ahead and commit/test/release that now, Tyler? > > So it sounds like a non privileged user on an Ubuntu machine can > insert a USB stick/etc with a file system that gets automatically > mounted, said file system can contain setuid root binaries for > example which the user can then execute, elevating privileges? Please use CVE-2012-3409 for the ecryptfs mount.ecryptfs_private which allows setuid and dev enabled filesystems, this affects multiple Linux vendors. Just to confirm: this only affects systems with a setuid mount.ecryptfs_private? - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJP/gvtAAoJEBYNRVNeJnmTRdgP/3TJHs/zz066JsOQIvBCjWMM hFGZjmDIjPdCbUtYioX/6aTR7NTUGdoLOlI9FwVVgBQhzEzdy/hoeD4fQKNje02a JFOTg1v/PhlqYhEDZxgMLiaY5yv4uQeDZk+/ZlFfOGEQhRfZXtdB3o1u8U5L1u7f Yo/ncDV+1+PCtPTtFQIp9/x//7mF2r0V5/ibvesCBmDicFmkLkmloBQFLdvlJeW5 muxhY1YYuu777CpWiYwY+59ZvqaeUODBUbGDwk5jQ0reDjwSafB8vz+DqKMbDlyT HNYJXASGCdOlxMgM0ic7pR0q9eWYo6YzhCoBG7OM0c+2tqFqeNDAKNa+HKxZFPkj 1kQL4Rq+nx6l8gaPFNFu+Wj36ryUvN5HXVlVS3F2puoHdPM1kAwE9D59hwT27e8P 2UF1JFRLLnjWAk8MXRPMOXSDh3Gd05P8xw+2/032KJmSaROfujt2kz1/wCHhY0ai gpc1oD4lf2SVC/9EM3vPx81MSYQWh1n+m8BqqT2TBGyZeSPXicW81QmPhyusJbp5 OMSBHy6gim2tSHZGK3+2HQNyB71vFDPyd78pa/mlCxcs5pkpR0uVTZHlwZvZclbB GGarAoNXBFbp4g120FE/MQp74Zi+0xOkt3MdMbvN7OOSOJk3Bi949oii+TDDK/D2 P10aNjcPiGhwoo7CfsmY =PPfw -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.