[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87lhn3w3jo.fsf@hope.eyrie.org>
Date: Sat, 22 Nov 2014 09:25:31 -0800
From: Russ Allbery <eagle@...ie.org>
To: Tim Brown <tmb@...35.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Running Java across a privilege boundry
Tim Brown <tmb@...35.com> writes:
> Does anyone know of any obvious cases where Java is executed across a
> privilege boundary? I'm specifically thinking of cases where it might be
> executed via sudo, via another set[ug]id binary or where it gets called
> from an untrusted working directory i.e. one not owned by the calling
> user?
"sudo service tomcat6 restart" would be a pretty obvious example that I
suspect is not uncommon in server environments.
In general, Java is a general-purpose programming language, so I think
there are plenty of examples of this just like there are with any other
programming language. Any large system written in Java probably has a few
Java command-line tools or ways to spawn Java daemons, and in the normal
course of setting up a system, it's likely that someone is granting access
to run those tools via sudo.
--
Russ Allbery (eagle@...ie.org) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
