Date: Tue, 21 Sep 2010 14:56:12 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Minor security flaw with pam_xauth On Mon, Aug 16, 2010 at 12:05:13PM +0100, Tim Brown wrote: > Here's another bug where privileged code isn't checking the return value from > setuid(): > > http://sourceforge.net/tracker/?func=detail&aid=3028213&group_id=6663&atid=106663 This is fixed in Linux-PAM 1.1.2: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6 The same commit also introduces previously-missing privilege switching into pam_env and pam_mail. Unfortunately, this pam_env and pam_mail fix is incomplete: it only switches the fsuid (should also switch fsgid (or egid) and groups), and it fails to check the return value from setfsuid() (doing so would require duplicate calls to setfsuid(), like we do in libtcb, or switching of euid instead - yet it is desirable). The pam_env and pam_mail issue was discovered by Sebastian Krahmer of SuSE. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ