Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 22 Nov 2014 14:11:14 -0500
From: Marc Chadwick <>
Cc: Tim Brown <>
Subject: Re: Running Java across a privilege boundry

On Nov 22, 2014 11:26 AM, "Russ Allbery" <> wrote:
> Tim Brown <> writes:
> > Does anyone know of any obvious cases where Java is executed across a
> > privilege boundary? I'm specifically thinking of cases where it might be
> > executed via sudo, via another set[ug]id binary or where it gets called
> > from an untrusted working directory i.e. one not owned by the calling
> > user?
> "sudo service tomcat6 restart" would be a pretty obvious example that I
> suspect is not uncommon in server environments.
> In general, Java is a general-purpose programming language, so I think
> there are plenty of examples of this just like there are with any other
> programming language.  Any large system written in Java probably has a few
> Java command-line tools or ways to spawn Java daemons, and in the normal
> course of setting up a system, it's likely that someone is granting access
> to run those tools via sudo.
> --
> Russ Allbery (              <>

I thought tomcat 6 used authbind in its init script, but I could be wrong.
If that's the case, authbind is written in C, so I'm not sure that's what
Tim has in mind. Similarly, jsvc is written in C. Maybe the tabuki wrapper

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.