[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110615220814.GC25196@nekral.nekral.homelinux.net>
Date: Thu, 16 Jun 2011 00:08:14 +0200
From: Nicolas François <nicolas.francois@...traliens.net>
To: oss-security@...ts.openwall.com
Cc: Ludwig Nussel <ludwig.nussel@...e.de>, Ondrej Vasik <ovasik@...hat.com>,
kzak@...hat.com
Subject: Re: /bin/su (was: CVE request -- coreutils -- tty
hijacking possible in "su" via TIOCSTI ioctl)
Hello,
On Wed, Jun 15, 2011 at 12:50:47PM +0200, Ondrej Vasik wrote:
>
> For me, having it in coreutils, shadow-utils, SimplePAMApps and possibly
> - in util-linux - could only cause a lot of confusion. Some
> consolidation might be better.
On one hand I agree, on the other hand I remember hard time getting rid of
Debian specific patches for su.
The behavior of -c changed and since dependencies to this tool are not
traced, there were no other ways than grep'ing the whole distro for those
two letters 'su' to prepare the transition.
One first step could be to compare their features and behaviors
PS: regarding the original issue, was the CVE requested? I would need the
number for documentation purpose.
Best Regards,
--
Nekral
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
