Full Disclosure mailing list archives
Re: DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop'
From: aCaB <aaacab () gmail com>
Date: Mon, 15 May 2006 10:15:50 +0200
FYI -------- Original Message -------- Subject: [Clamav-team] Next 'security' advisory Date: Mon, 15 May 2006 09:47:28 +0200 From: Tomasz Kojm <tkojm () clamav net> To: ClamAV Security <clamav-security () lists clamav net> In this case, the author failed to understand that: * freshclam cannot drop privileges before parsing the config file because it must first read the value of DatabaseOwner from freshclam.conf * privilege dropping was added to make the sysadmin's life easier * if one can run freshclam as root then one can always use --user=root to bypass the privilege dropping and thus that security advisory is not worth a pound * instead of giving regular users root privileges to run freshclam, every sensible sysadmin will add them to a proper group in /etc/group so they can write to the ClamAV database directory (if he really wants that, of course) I'm not subscribed to bugtraq but would appreciate if one could forward my response. Thanks, -- oo ..... Tomasz Kojm <tkojm () clamav net> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Mon May 15 09:43:17 CEST 2006 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop' KF (lists) (May 14)
- Re: DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop' aCaB (May 15)