Re: Splitvt exploit

[joey () KITENET NET (Joey Hess)]

Andrey Savochkin wrote:
> > +           /* Same for gid (program may be setgid utmp on some
> > +            * systems). */
> > +           (void) setgid(getgid());
> >                     
> >             /* Run the requested program, with possible leading dash. */
> >             execvp(((*argv[0] == '-') ? argv[0]+1 : argv[0]), argv);
>
> I don't know what splitvt is, but shouldn't setgid go _before_ setuid call
> for dropping privileges?

Yes it should, although in reality it's not going to change anything
(splitvt has no conceivable reason to be setuid and setgid at the same
time). Someone pointed that out yesterday and I've changed my
patch. I guess I'll post this to bugtraq too since several people have
pointed that out now.

--
see shy jo