[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231106155327.vekxv4lvtal44aaw@jwilk.net>
Date: Mon, 6 Nov 2023 16:53:27 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
Subject: Re: Session File Relative Path Traversal in sudo-rs
* Alan Coopersmith <alan.coopersmith@...cle.com>, 2023-11-02 11:40:
>This vulnerability requires two pre-conditions:
>
>1) Your OS allows usernames containing both '.' and '/' characters.
>
>2) Your site allows users to create usernames containing both '.' and
>'/' characters, with no process or manual review that denies such
>things.
>
>If both are true, when sudo-rs created a filename containing the
>username, it failed to escape the characters, letting them be
>interpreted by the filesystem as references to higher level directories
>('/../..' etc.)
The original sudo implementation is affected too:
https://github.com/sudo-project/sudo/commit/7363ad7b3230b7b0
https://ferrous-systems.com/blog/sudo-rs-audit/ says it's "a lower
security severity due to [sudo's] use of the openat function", but I
can't see how openat() would help.
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
