[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110516142741.GA24816@suse.de>
Date: Mon, 16 May 2011 16:27:41 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Multiple libraries privilege checking
Hi,
Its probably about time to review libraries that are commonly
linked to (formerly-) suid programs, such as
libldap, libssl etc. In near future, in the advent of file caps
they are often lacking proper checks.
They usually just compare uid against euid (not even gid sometimes)
and do not check the dumpable flag or AT_SECURE (dont know whether
glibc exports a proper function to easily check that at all).
The libraries that I had a quick look at and which were found
"vulnerable" are:
- openssl-1.0.0c
- openldap-2.4.23
- cyrus-sasl-2.1.23
which is probably far from complete. Even if not linked directly to
a privileged running program, these libraries may be introduced by
plugins or frameworks (pam etc).
As a result, attackers may specify plugin directories or rouge directory
services for authentication as these libraries think they are
running unprivileged.
So better to fix them now than to be sorry in one year when they are going
to be used the fscaps-way.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
