Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 Nov 2012 11:21:08 +0100
From: vladz <>
To: halfdog <>
Subject: Re: TTY handling when executing code in different
 lower-privileged context (su, virt containers)

On Mon, Nov 05, 2012 at 07:22:37PM +0000, halfdog wrote:
> During programming experiments I found some class of vulnerabilities
> [1], that seem to be rediscovered again from time to time, but since
> attack value is questionable, it was not fixed yet.

Nice.  I was just wondering why the SIGSTOP signal is used here?
Sending a string starting with "exit;" to close the child process also
does the trick, no?  When [1] was posted on the oss list, I wrote this
little PoC [2] to hijacked interactive bash shell opened with "su -

> I would like to propose following "fix" for this problem: Modification
> of man-page of su making this a known problem or feature, not a bug.

Changing the man page is a good idea.  Administrators (good ones) should
never have to open users's interactive shells.  I mean, beside being a
security problem, it's kind of invasion of privacy. ;)



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.