oss-security - Re: CVE request (and disclosure): ax25d missing setuid return code check

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <604670952.2041759.1313172438084.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Fri, 12 Aug 2011 14:07:18 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: csmall@...ian.org, coley <coley@...re.org>
Subject: Re: CVE request (and disclosure): ax25d missing
 setuid return code check



----- Original Message -----
> The AX.25 daemon (ax25d), typically provided in the ax25-tools
> package, allows administrators to associate incoming AX.25, NET/ROM,
> and ROSE traffic with the execution of an endpoint program (most
> commonly "node"), which is run under a specified user account.
> Because ax25d is missing a check on the return code for a setuid call
> responsible for dropping privileges to the specified user, it may be
> possible to cause setuid to fail, after which the chosen program will
> be executed with root privileges. In other words, if you're in the
> business of handing out unprivileged shells over amateur radio (don't
> we all? :p ), this would allow for remote compromise.
> 

Please use CVE-2011-2910

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.