[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20120913181817.371dda1b@redhat.com>
Date: Thu, 13 Sep 2012 18:18:17 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: libdbus hardening
On Tue, 10 Jul 2012 16:11:12 +0200 Sebastian Krahmer wrote:
> If you compile your openssh '--with-ssl-engine' you have
> an easy root exploit (given that ssh-keysign is mode 04755
> such as on Debian) via OPENSSL_config().
Even though the above is not correct to the best of my knowledge (no
openssh version I checked would call OPENSSL_config(NULL) from
ssh-keysign, even when it's complied with --with-ssl-engine and
installed setuid root; even though other openssh command line tools do
end up calling OPENSSL_config(NULL)), this shows OpenSSL is not
unlikely to be used in a privileged application and hence may allow
privilege escalation via special OPENSSL_CONF or OPENSSL_ENGINES
environment variables.
OpenSSL also already protects access to certain environment variables
(there are OPENSSL_issetugid() calls before getenv()), it does not do
the same check for all variables it reads. It seems that problem
deserves a CVE.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
