oss-sec mailing list archives
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
From: "daniel () ruoso com" <daniel () ruoso com>
Date: Mon, 06 Jun 2011 16:38:49 -0400
Josh Bressers <bressers () redhat com> wrote:
This really shouldn't get a CVE id. It's well known, and sadly, not easy to fix. There are more details in this bug: https://bugzilla.redhat.com/show_bug.cgi?id=479145
I failed to see why setsid() doesn't prevent the priviledges escalation. AFAIU the exploit is only possible if the process has a controlling tty, which is prevented by setsid()
I would classify this as an administration issue, not a flaw in su or sudo. If you're running arbitrary things, you're in far more trouble than this.
Well, you're not running arbitrary things, you're running commands as a less priviledged user under the assumption that it will be restricted to that user. The scenario of having this less priviledged user compromised without admin knowledge is not far from real. I, for instance, use su -u to run commands as the www user, what are the odds of that user being compromised without my knowledge? The last thing I want is having a way for that compromised user to run arbitrary commands as any other user. Daniel
Current thread:
- CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Jan Lieskovsky (Jun 02)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Michael Gilbert (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl daniel () ruoso com (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 08)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 09)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 10)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ludwig Nussel (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Luka Marinko (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ondrej Vasik (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Karel Zak (Jun 20)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)