Date: Wed, 17 Oct 2012 13:42:34 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Raphael Geissert <geissert@...ian.org> Subject: Re: CVE-2012-2248: isc-dhcp, Debian-specific: build path included in PATH -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/15/2012 02:50 PM, Raphael Geissert wrote: > Hi, > > Michael Stapelberg, Tollef Fog Heen, and Michael Biebl discovered > that dhclient was setting dhclient-script's PATH to one that > included a subdirectory of the build directory. This issue is > caused by the way isc-dhcp is packaged in Debian. > > At least two versions of isc-dhcp for the amd64 (x86_64) > architecture in Debian were found two be setting PATH to a > subdirectory of /home/zero79/, which would allow a user with such > HOME directory to be able to execute code as root. > > To clarify the bug report: it is not specific to samba or hooks in > general, PATH is injected in the environment passed to the execve() > call that executes dhclient-script. > > Since this issue doesn't affect the stable release, there won't be > a DSA. This email is just a heads up. > > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690532 > > Cheers, > Was this software released however? - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQfwoqAAoJEBYNRVNeJnmTFa4P/iUGrMc3zt23oqMySqzacrkN hzj/zw3xJEFOFZMeTXg2ZUlS3KrUaqolZh6Btlku9EUWVUp+6GudqSE4p/Cr4cL5 fHj2UoTf7X3RjDv8lyqRNbvtJc6eqRBc5iL2UPwXkTFOBA4dHhIV3/PcxoLNLol/ uLYnH7Q6oAa8bJdJYWPo6rh2aMGxR6b2ewXqnVWckOCdrcQD6tfNDHgYji1NC/oh wcdD3AxvYhxlKiI6+mWy548LG8fJ0bYpx020rkYYldJUre0Frn8TjogoxmEDyyWF 2Ohhnl3EmjlxM2l0FyKSmUZxsb4aRLkLHqNAmk6b33U5czoti1zsHqmzvMjAAb+d g9IjNkZu/SSTt1ma8MZHd1LDRcM+6gqydTXcdXeuehTcELE5zKUPo4nUQXVKXnxg CrQDLxRqX0/a6fyc1pLpdWrO0XAHJbCoGdL4nAkI/LlQzQM9K8j9gxkZ4hrWfUwZ 6tbUBqAnglKLVwUhmRmEeKuFSkuoGq2TZeJEbivbqytxyvcmYUzbb+pDdKydnA4o bIFxQ+lMmouQAIGZB+MwrKQ2PGcAPi5DqHaW/ko0o42xlkyhzVy22fFVNh0AgD7y NlUZp181WwBrwg4tRKlFHSG0CYq9aKMXIDZL4EAq9cEV8B0WOf/EsVUT3lrXh0dZ 1JSFcLEl9rje9PawjOfD =xqMN -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.