Date: Tue, 17 Jun 2014 15:46:06 +0200 From: Tomas Hoger <thoger@...hat.com> To: graham.dumpleton@...il.com Cc: oss-security@...ts.openwall.com Subject: Re: Security release for mod_wsgi (version 3.5) On Tue, 17 Jun 2014 22:39:49 +1000 Graham Dumpleton wrote: > So just to be safe one could in all cases exit anyway, but I believe > the possibility that these could cause an issue is extremely limited, > with the only case being where the user provides a bad gid for #nnn > to the 'group' option which did actually exceed some integer range > which was actually enforced by the operating system being used. If > they used an actual group name, which would be the typical case, they > shouldn't be able to trigger a problem. My concern was more about things that are outside your control and can still cause set*id calls to fail even if you feed them with sane data. Some of these include other errors that can be encountered inside syscall (e.g. memory allocation issues), capability issues, or simply having MAC system (think SELinux) policy denying id change. Those were mentioned here: http://www.openwall.com/lists/oss-security/2011/08/11/6 http://www.openwall.com/lists/oss-security/2011/08/11/9 Of course, while none of these are known to offer such easily and widely usable attack vector as RLIMIT_NPROC causing setuid failure, it seems reasonable to fix all properly while at it. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.