[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <507F0A2A.2020200@redhat.com>
Date: Wed, 17 Oct 2012 13:42:34 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Raphael Geissert <geissert@...ian.org>
Subject: Re: CVE-2012-2248: isc-dhcp, Debian-specific: build
path included in PATH
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/15/2012 02:50 PM, Raphael Geissert wrote:
> Hi,
>
> Michael Stapelberg, Tollef Fog Heen, and Michael Biebl discovered
> that dhclient was setting dhclient-script's PATH to one that
> included a subdirectory of the build directory[1]. This issue is
> caused by the way isc-dhcp is packaged in Debian.
>
> At least two versions of isc-dhcp for the amd64 (x86_64)
> architecture in Debian were found two be setting PATH to a
> subdirectory of /home/zero79/, which would allow a user with such
> HOME directory to be able to execute code as root.
>
> To clarify the bug report: it is not specific to samba or hooks in
> general, PATH is injected in the environment passed to the execve()
> call that executes dhclient-script.
>
> Since this issue doesn't affect the stable release, there won't be
> a DSA. This email is just a heads up.
>
> [1]http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690532
>
> Cheers,
>
Was this software released however?
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQfwoqAAoJEBYNRVNeJnmTFa4P/iUGrMc3zt23oqMySqzacrkN
hzj/zw3xJEFOFZMeTXg2ZUlS3KrUaqolZh6Btlku9EUWVUp+6GudqSE4p/Cr4cL5
fHj2UoTf7X3RjDv8lyqRNbvtJc6eqRBc5iL2UPwXkTFOBA4dHhIV3/PcxoLNLol/
uLYnH7Q6oAa8bJdJYWPo6rh2aMGxR6b2ewXqnVWckOCdrcQD6tfNDHgYji1NC/oh
wcdD3AxvYhxlKiI6+mWy548LG8fJ0bYpx020rkYYldJUre0Frn8TjogoxmEDyyWF
2Ohhnl3EmjlxM2l0FyKSmUZxsb4aRLkLHqNAmk6b33U5czoti1zsHqmzvMjAAb+d
g9IjNkZu/SSTt1ma8MZHd1LDRcM+6gqydTXcdXeuehTcELE5zKUPo4nUQXVKXnxg
CrQDLxRqX0/a6fyc1pLpdWrO0XAHJbCoGdL4nAkI/LlQzQM9K8j9gxkZ4hrWfUwZ
6tbUBqAnglKLVwUhmRmEeKuFSkuoGq2TZeJEbivbqytxyvcmYUzbb+pDdKydnA4o
bIFxQ+lMmouQAIGZB+MwrKQ2PGcAPi5DqHaW/ko0o42xlkyhzVy22fFVNh0AgD7y
NlUZp181WwBrwg4tRKlFHSG0CYq9aKMXIDZL4EAq9cEV8B0WOf/EsVUT3lrXh0dZ
1JSFcLEl9rje9PawjOfD
=xqMN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
