Date: Mon, 24 Mar 2014 10:27:23 +0100 From: Sebastian Krahmer <krahmer@...e.de> To: oss-security@...ts.openwall.com Subject: KAuth security issues I sent this to security@....org last week and to some KDE developers one more week ago. No response so far, so here we go. regards, Sebastian --------8<-------------------- Hi I sent this mail to the KAuth author a week ago. So far no reply, so I am trying it here again. When I looked at the KAuth framework it seems like it is using PolkitQt1::UnixProcessSubject subject(pid) (i.e. unix process subjects) for the polkit auth, which is always racy. Please refer to: CVE-2013-4288 polkit: unix-process subject for authorization is racy CVE-2013-4311 libvirt: insecure calling of polkit via libgobject API CVE-2013-4324 spice-gtk: use of insecure polkit libgobject-1 API CVE-2013-4325 hplip: use of insecure polkit DBUS API CVE-2013-4326 rtkit: use of insecure polkit DBUS API CVE-2013-4327 systemd: use of insecure polkit DBUS API which were using exactly this vulnerable way auf authenticating via polkit. The bug is semi-public: https://bugzilla.novell.com/show_bug.cgi?id=864716 A non-racy way would be to use system-bus subject for authentication. (Yet I dont know how this fits in the KAuth API). Nevertheless, there needs to be done something, as basically the KAuth authentication is non-existing if using process subjects. regards, Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team ----- End forwarded message ----- -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.