[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54DB1D78.1010901@redhat.com>
Date: Wed, 11 Feb 2015 10:14:32 +0100
From: Florian Weimer <fweimer@...hat.com>
To: cve-assign@...re.org
CC: oss-security@...ts.openwall.com
Subject: Re: Re: CVE request: sudo TZ issue
On 02/11/2015 06:59 AM, cve-assign@...re.org wrote:
>> http://www.sudo.ws/alerts/tz.html
>
> We are not sure why this is being interpreted as a vulnerability
> in sudo that should have a CVE assignment in which sudo is the
> responsible product. It appears that you are adding a new security
> feature in which sudo chooses to help prevent exploitation of bugs
> in a system library such as libc.
Changing environment variables is not compliant with the prevalent
interpretation of of POSIX, and as a result, at least glibc will not
change its behavior. This means that AT_SECURE programs such as sudo
need to implement proper filtering.
I will obtain clarification from the Austin Group that scrubbing
environment variables in the implementation name space is allowed, and
then we can revisit this matter as far as glibc is concerned.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
