Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8737ke7byg.fsf@mid.deneb.enyo.de>
Date: Sun, 02 Oct 2016 22:06:15 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: NSPR 4.12, NSS 3.22.1 and PR_GetEnvSecure

It seems this was never disclosed properly; there are still a couple
of hidden Mozilla bugs about this.

The NSS 3.22.1 announcement

  <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.22.1_release_notes>

mentions one:

  bug 1194680: NSS has been changed to use the PR_GetEnvSecure
    function that was made available in NSPR 4.12

The story behind this is that NSS uses environment variables to
configure lots of things, some of which refer to file system
locations.  Others can be degrade the operation of NSS in various
ways, forcing compatibility modes and so on.

Previously, these environment variables were not ignored SUID
binaries.  NSPR 4.12 and NSS 3.22.1 introduce a new API,
PR_GetEnVSecure, to address this.  It's a very thin wrapper around
glibc's secure_getenv and similar functions on other systems.

Both NSPR and NSS need to be upgraded to address this; even if you run
s/PR_GetEnvSecure/secure_getenv/ on the NSS sources, some unprotected
environment variable lookups remain in NSPR.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.