Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170604013502.GA21482@lizzie.io>
Date: Sat, 3 Jun 2017 18:35:14 -0700
From: Lizzie Dixon <_@...zie.io>
To: oss-security@...ts.openwall.com
Subject: Re: TIOCSTI not going away

On 06/03, Solar Designer wrote:
> Hi,
> 
> Many su-like programs can be used to run other programs with reduced (or
> otherwise different, rather than strictly elevated) privileges.  This
> includes su itself (such as when su'ing from root to a user), as well as
> various container entry commands, etc.
> 
> Many (probably most) of those got it wrong at first, keeping the same
> tty across the privilege boundary.  Numerous such issues were reported:
>
> [...]
> 
> This list is not exhaustive.

For the benefit of the list: busybox su also has this issue, but the
maintainer has declined to fix it.

https://bugs.busybox.net/show_bug.cgi?id=9401

Best,

L.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.