Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55327D1F.5070807@gmx.de>
Date: Sat, 18 Apr 2015 17:49:51 +0200
From: Harald Becker <ralda@....de>
To: musl@...ts.openwall.com
CC: Matt Johnston <matt@....asn.au>
Subject: Re: Re: Security advisory for musl libc - stack-based buffer
 overflow in ipv6 literal parsing [CVE-2015-1817]

On 18.04.2015 17:25, Rich Felker wrote:
>> The server hostkey will remain in process
>> memory since it's required for rekeying - not as bad as root
>> code execution though.
>
> Ugly. I don't see how this can be solved without a more advanced
> privsep model. I agree it's lower-severity though.

IMO you may put the host keys in a file readable (not writable) with a 
dropbear group, and only using that group for dropbear (no other users 
or programs using that group). So you may read the keys even if not 
root, if you add this dropbear group to setgroups (not setgid) before 
dropping root privileges.

Harald

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.