Re: CVE request: oping allows the disclosure of arbitrary file contents

[Josh Bressers <bressers () redhat com>]

----- "Julien Tinnes" <jt () cr0 org> wrote:
> in case anyone cares, oping also attempts to drop privileges with
> setuid(getuid()); without checking setuid()'s return value.
>
> It's an obvious vulnerability, because a local attacker can make
> setuid() fail by setting a resource limit of 0 for RLIMIT_NPROC with
> setrlimit().

Does that have any security implications though? I've not looked at the app.
If it's a security problem, I'll give it a CVE id.

Thanks.

-- 
    JB