[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100921105612.GA5579@openwall.com>
Date: Tue, 21 Sep 2010 14:56:12 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Minor security flaw with pam_xauth
On Mon, Aug 16, 2010 at 12:05:13PM +0100, Tim Brown wrote:
> Here's another bug where privileged code isn't checking the return value from
> setuid():
>
> http://sourceforge.net/tracker/?func=detail&aid=3028213&group_id=6663&atid=106663
This is fixed in Linux-PAM 1.1.2:
http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6
The same commit also introduces previously-missing privilege switching
into pam_env and pam_mail. Unfortunately, this pam_env and pam_mail fix
is incomplete: it only switches the fsuid (should also switch fsgid (or
egid) and groups), and it fails to check the return value from setfsuid()
(doing so would require duplicate calls to setfsuid(), like we do in
libtcb, or switching of euid instead - yet it is desirable).
The pam_env and pam_mail issue was discovered by Sebastian Krahmer of SuSE.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
