oss-sec mailing list archives
Re: Security release for mod_wsgi (version 3.5)
From: Tomas Hoger <thoger () redhat com>
Date: Tue, 17 Jun 2014 13:27:51 +0200
On Wed, 21 May 2014 11:46:32 +0200 Kurt Seifried wrote:
So CVEs were assigned, this is now public, very well written an detailed write up is at: http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
...
Issue: Possibility of local privilege escalation when using daemon mode. (CVE-2014-0240) The issue is believed to affect Linux systems running kernel versions= 2.6.0 and < 3.1.0.The issue affects all versions of mod_wsgi up to and including version 3.4. The source of the issue derives from mod_wsgi not correctly handling Linux specific error codes from setuid(), which differ to what would be expected to be returned by UNIX systems conforming to the Open Group UNIX specification for setuid().
Looking at the patch, mod_wsgi was previously expecting that setuid may return error, it only failed to respond to the failure correctly. It only logged information about the failure, and continued to run with unexpected privileges. Few lines above the patched code, the same pattern is used for setgid and setgroups / initgroups calls. Is there a reason to not patch those in the same way? While there may be no such easy way to trigger failure for those, their failure would also lead to user code running with unexpected privileges. -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- Security release for mod_wsgi (version 3.5) Kurt Seifried (May 21)
- Re: Security release for mod_wsgi (version 3.5) Tomas Hoger (Jun 17)
- Re: Security release for mod_wsgi (version 3.5) Graham Dumpleton (Jun 17)
- Re: Security release for mod_wsgi (version 3.5) Tomas Hoger (Jun 17)
- Re: Security release for mod_wsgi (version 3.5) Seth Arnold (Jun 17)
- Re: Security release for mod_wsgi (version 3.5) Matthew Daley (Jun 18)
- Re: Security release for mod_wsgi (version 3.5) Solar Designer (Jun 18)
- Re: Security release for mod_wsgi (version 3.5) Graham Dumpleton (Jun 18)
- Re: Security release for mod_wsgi (version 3.5) Graham Dumpleton (Jun 18)
- CVE request: mod_wsgi group privilege dropping [was Re: [oss-security] Security release for mod_wsgi (version 3.5)] Murray McAllister (Jun 18)
- Re: Security release for mod_wsgi (version 3.5) Graham Dumpleton (Jun 17)
- Re: Security release for mod_wsgi (version 3.5) Tomas Hoger (Jun 17)