oss-sec mailing list archives
Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
From: Josh Bressers <bressers () redhat com>
Date: Tue, 21 Jun 2011 10:59:15 -0400 (EDT)
----- Original Message -----
Jan Lieskovsky wrote:Hello Josh, Steve, vendors, based on Debian BTS report: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843 (first CVE-2011-XXYY required for Debian case) looked more into original report: [2] https://bugzilla.redhat.com/show_bug.cgi?id=173008 and the first paragraph of [2] suggests: "When starting a program via "su - user -c program" the user session can escape to the parent session by using the TIOCSTI ioctl to push characters into the input buffer. This allows for example a non-root session to push "chmod 666 /etc/shadow" or similarly bad commands into the input buffer such that after the end of the session they are executed." this should get a CVE-2005-YYZZ CVE id. Could you allocate these?ping! :-)
I'm not sure if this should get two IDs. It's really one issue, which isn't actually fixed in su. The fundamental issue is that tools like su and sudo keep the tty open. The patch in question closes the tty for the case of su -c, but not for just running su by itself. It is incomplete. It should get a 2005 ID at the very least, MITRE will have to do that. Perhaps two 2005 IDs? One for the issue, the second for the incomplete fix (which is still not fixed)? I think the bigger issue is it needs to be decided what is proper behavior and document that. I'm not smart enough to know if this can be fixed properly without crippling these tools. Thanks. -- JB
Current thread:
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl, (continued)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 09)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 10)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ludwig Nussel (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Luka Marinko (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ondrej Vasik (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Karel Zak (Jun 20)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Nicolas François (Jun 15)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 21)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 22)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Todd C. Miller (Jun 22)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 28)