oss-sec mailing list archives
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Wed, 22 Jun 2011 10:19:23 -0400
On Wed, 22 Jun 2011 15:41:09 +0200, Ludwig Nussel wrote:
Newer sudo actually have a use_pty option that fixes the problem. It's not enabled by default though. As I just found out there's also code missing to make sudo actually honor the option in the config (patch attached, CC'd upstream).
Thanks for the patch, it will be part of sudo 1.8.2.
Introducing similar code in su would be possible but requires some programming effort. sudo has a liberal licence though so the code could probably be reused.
The level of effort involved depends on whether or not you need job control to work between the user's tty and the command running in the pty. Sudo proxies job control signals via an extra process so that for, e.g. "sudo vi foo", the vi process be suspended by ^Z even when it is running in a pty. I don't think that people using "su -c command" have the same expectations so it is probably not worth the extra effort. - todd
Current thread:
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl, (continued)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ludwig Nussel (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Luka Marinko (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ondrej Vasik (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Karel Zak (Jun 20)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 21)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 22)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Todd C. Miller (Jun 22)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 28)