oss-sec mailing list archives
Multiple libraries privilege checking
From: Sebastian Krahmer <krahmer () suse de>
Date: Mon, 16 May 2011 16:27:41 +0200
Hi, Its probably about time to review libraries that are commonly linked to (formerly-) suid programs, such as libldap, libssl etc. In near future, in the advent of file caps they are often lacking proper checks. They usually just compare uid against euid (not even gid sometimes) and do not check the dumpable flag or AT_SECURE (dont know whether glibc exports a proper function to easily check that at all). The libraries that I had a quick look at and which were found "vulnerable" are: - openssl-1.0.0c - openldap-2.4.23 - cyrus-sasl-2.1.23 which is probably far from complete. Even if not linked directly to a privileged running program, these libraries may be introduced by plugins or frameworks (pam etc). As a result, attackers may specify plugin directories or rouge directory services for authentication as these libraries think they are running unprivileged. So better to fix them now than to be sorry in one year when they are going to be used the fscaps-way. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany
Current thread:
- Multiple libraries privilege checking Sebastian Krahmer (May 16)
- Re: Multiple libraries privilege checking Solar Designer (May 16)
- Re: Multiple libraries privilege checking Dmitry V. Levin (May 16)
- Re: Multiple libraries privilege checking Sebastian Krahmer (May 17)
- Re: Multiple libraries privilege checking Solar Designer (May 18)
- Re: Multiple libraries privilege checking Sebastian Krahmer (May 22)
- Re: Multiple libraries privilege checking yersinia (May 18)
- Re: Multiple libraries privilege checking Solar Designer (May 18)
- Re: Multiple libraries privilege checking Solar Designer (May 16)
- Re: Multiple libraries privilege checking Florian Weimer (Jun 19)