[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZBBQifYr6J8OSNXP@doggett>
Date: Tue, 14 Mar 2023 11:46:33 +0100
From: Peter Bex <peter@...e-magic.net>
To: oss-security@...ts.openwall.com
Subject: Re: TTY pushback vulnerabilities / TIOCSTI
On Tue, Mar 14, 2023 at 09:51:03AM +0100, Hanno Böck wrote:
> This seems to be the only real mitigation for this issue. It appears
> su has a parameter, and in sudo one can configure the creation of a new
> pty in the sudoers file. I don't consider these as satisfying fixes, as
> they are optinal, and thus rely on the expectation that users are aware
> of this risk and manually use these mitigations. That does not seem
> realistic to me.
Indeed, opendoas (the portable version of OpenBSD's "doas") has this
exact bug as well: https://github.com/Duncaen/OpenDoas/issues/106
Cheers,
Peter
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
