Date: Mon, 6 Nov 2023 16:53:27 +0100 From: Jakub Wilk <jwilk@...lk.net> To: <oss-security@...ts.openwall.com> Subject: Re: Session File Relative Path Traversal in sudo-rs * Alan Coopersmith <alan.coopersmith@...cle.com>, 2023-11-02 11:40: >This vulnerability requires two pre-conditions: > >1) Your OS allows usernames containing both '.' and '/' characters. > >2) Your site allows users to create usernames containing both '.' and >'/' characters, with no process or manual review that denies such >things. > >If both are true, when sudo-rs created a filename containing the >username, it failed to escape the characters, letting them be >interpreted by the filesystem as references to higher level directories >('/../..' etc.) The original sudo implementation is affected too: https://github.com/sudo-project/sudo/commit/7363ad7b3230b7b0 https://ferrous-systems.com/blog/sudo-rs-audit/ says it's "a lower security severity due to [sudo's] use of the openat function", but I can't see how openat() would help. -- Jakub Wilk
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.