Re: Splitvt exploit

[saw () SAW SW COM SG (Andrey Savochkin)]

Hello,

On Wed, Jun 14, 2000 at 07:28:37PM -0700, Joey Hess wrote:
> Note that in addition to the above fix, version 1.6.4-3 of splitvt in
> Debian is no longer suid root, just sgid utmp. If any further security
> holes are found (the program could use a thurough audit), I hope this
> will greatly reduce the magnitude of the exploit. A patch for glibc
> systems follows, which I have already sent to the author of splitvt.
[snip]
> @@ -108,6 +108,9 @@
>
>               /* Set our uid to our real uid if necessary */
>               (void) setuid(getuid());
> +             /* Same for gid (program may be setgid utmp on some
> +              * systems). */
> +             (void) setgid(getgid());
>                       
>               /* Run the requested program, with possible leading dash. */
>               execvp(((*argv[0] == '-') ? argv[0]+1 : argv[0]), argv);

I don't know what splitvt is, but shouldn't setgid go _before_ setuid call
for dropping privileges?

Best regards
                                        Andrey V.
                                        Savochkin