oss-sec mailing list archives
super unchecked setuid (CVE-2014-0470)
From: Florian Weimer <fw () deneb enyo de>
Date: Mon, 28 Apr 2014 19:55:08 +0200
Robert's patch, reproduced below, has all the details. From: Robert Luberda <robert () debian org> Date: Wed, 23 Apr 2014 00:28:19 +0200 Subject: 14 Fix unchecked setuid call Fix the following issue noticed by John Lightsey: super.c does an unchecked setuid(getuid()) when the -F flag is supplied pointing to a configuration file to test. This opens super up to the RLIM_NPROC style exploits on 2.6 kernels. The issue was assigned number CVE-2014-0470. --- super.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/super.c b/super.c index abea061..1c21886 100644 --- a/super.c +++ b/super.c @@ -849,7 +849,9 @@ by `-o %s' is overridden by file `%s'", *o_file, superfile); * to the real uid. */ if (getuid() != 0) { - setuid(getuid()); + if (setuid(getuid()) == -1) + Error(1, 1, "Can't set uid to %d: ", getuid()); + fprintf(stderr, "\t** Since you have supplied a super.tab file that isn't the default,\n"); fprintf(stderr,
Current thread:
- super unchecked setuid (CVE-2014-0470) Florian Weimer (Apr 28)