oss-security - Re: CVE Request (syslog-ng)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 17 Nov 2008 23:06:53 +0100
From: Andreas Ericsson <ae@....se>
To: oss-security@...ts.openwall.com
CC: coley@...re.org
Subject: Re: CVE Request (syslog-ng)

Steven M. Christey wrote:
> On Mon, 17 Nov 2008, Josh Bressers wrote:
> 
>> syslog-ng doesn't call chdir() before calling chroot().
> 
> This falls under the notion of "protection mechanism works less securely
> than advertised" so is a clear case for inclusion in CVE.  Use
> CVE-2008-5110.
> 
> Also - is the chdir supposed to come BEFORE or AFTER?  The CERT secure
> coding rules here:
> 
> https://www.securecoding.cert.org/confluence/display/cplusplus/FIO16-CPP.+Limit+access+to+files+by+creating+a+jail
> 
> suggest it might be safer AFTER, not before, due to some race condition
> possibilities.
> 

The correct sequence is:
chdir(jail_path);
chroot(".");

The chroot() call will fail if the directory no longer exists, but is
otherwise safe from "racy jail" attacks.

Paranoid programs only accept absolute non-symlink paths to the jail
and issue getcwd() after having entered it to make sure they ended up
in the proper directory.

-- 
Andreas Ericsson                   andreas.ericsson@....se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.