Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Sep 2010 14:56:12 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Minor security flaw with pam_xauth

On Mon, Aug 16, 2010 at 12:05:13PM +0100, Tim Brown wrote:
> Here's another bug where privileged code isn't checking the return value from 
> setuid():
> 
> http://sourceforge.net/tracker/?func=detail&aid=3028213&group_id=6663&atid=106663

This is fixed in Linux-PAM 1.1.2:

http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6

The same commit also introduces previously-missing privilege switching
into pam_env and pam_mail.  Unfortunately, this pam_env and pam_mail fix
is incomplete: it only switches the fsuid (should also switch fsgid (or
egid) and groups), and it fails to check the return value from setfsuid()
(doing so would require duplicate calls to setfsuid(), like we do in
libtcb, or switching of euid instead - yet it is desirable).

The pam_env and pam_mail issue was discovered by Sebastian Krahmer of SuSE.

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.