[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8737ke7byg.fsf@mid.deneb.enyo.de>
Date: Sun, 02 Oct 2016 22:06:15 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: NSPR 4.12, NSS 3.22.1 and PR_GetEnvSecure
It seems this was never disclosed properly; there are still a couple
of hidden Mozilla bugs about this.
The NSS 3.22.1 announcement
<https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.22.1_release_notes>
mentions one:
bug 1194680: NSS has been changed to use the PR_GetEnvSecure
function that was made available in NSPR 4.12
The story behind this is that NSS uses environment variables to
configure lots of things, some of which refer to file system
locations. Others can be degrade the operation of NSS in various
ways, forcing compatibility modes and so on.
Previously, these environment variables were not ignored SUID
binaries. NSPR 4.12 and NSS 3.22.1 introduce a new API,
PR_GetEnVSecure, to address this. It's a very thin wrapper around
glibc's secure_getenv and similar functions on other systems.
Both NSPR and NSS need to be upgraded to address this; even if you run
s/PR_GetEnvSecure/secure_getenv/ on the NSS sources, some unprotected
environment variable lookups remain in NSPR.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
