[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111014081339.GA3598@albatros>
Date: Fri, 14 Oct 2011 12:13:39 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: radvd 1.8.2 released with security fixes
Hi Huzaifa,
On Fri, Oct 14, 2011 at 10:15 +0530, Huzaifa Sidhpurwala wrote:
> I dont think so. From the code i have read so far, here is what
> seems to happen.
>
> - radvd starts as root
> - reads the configs
> - if a username is specified (user=radvd in most cases):
> - if "--singleprocess" is not specified:
> - run privsep_init(): This forks another process which
> runs as root. So after this point we have two
> processes both running as root
> - If privsep_init() fails, we have just one process
> running as root
> - run drop_root_privileges():
> If this succedes, we have two processes one running as
> root and another as radvd user, or if privsep_init()
> failed earlier, we have one process running as radvd
> user.
> If this fails, application quits
> - If username was not specified radvd continues to run as a single
> process as root.
>
>
> So failure in privsep_init() results in just one process running as
> radvd user. If it did not fail it would result in one process
> running as root and another as radvd user.
>
> I dont think this would be a security issue in my opinion.
Indeed, if privsep_init() fails the only visible change would be no
future changes to interface settings. I was misled by the option name -
it looks like privsep disabling (opposition to --username), but in
reality it totally disables privileged operations.
Thanks for spotting it, I think CVE-2011-3603 should be rejected.
--
Vasiliy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
