Re: CVE request: oping allows the disclosure of arbitrary file contents

[Tomas Hoger <thoger () redhat com>]

On Thu, 15 Oct 2009 15:15:57 +0200 Julien Tinnes <jt () cr0 org> wrote:

> in case anyone cares, oping also attempts to drop privileges with
> setuid(getuid()); without checking setuid()'s return value.
>
> It's an obvious vulnerability, because a local attacker can make
> setuid() fail by setting a resource limit of 0 for RLIMIT_NPROC with
> setrlimit().

Does the RLIMIT_NPROC trick work against oping, or any setuid app that
calls setuid(getuid())?

-- 
Tomas Hoger / Red Hat Security Response Team