oss-sec mailing list archives
CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Thu, 02 Jun 2011 19:23:14 +0200
Hello Josh, Steve, vendors, based on Debian BTS report: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843 (first CVE-2011-XXYY required for Debian case) looked more into original report: [2] https://bugzilla.redhat.com/show_bug.cgi?id=173008 and the first paragraph of [2] suggests: "When starting a program via "su - user -c program" the user session can escape to the parent session by using the TIOCSTI ioctl to push characters into the input buffer. This allows for example a non-root session to push "chmod 666 /etc/shadow" or similarly bad commands into the input buffer such that after the end of the session they are executed." this should get a CVE-2005-YYZZ CVE id. Could you allocate these? Thank you & Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Jan Lieskovsky (Jun 02)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Michael Gilbert (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl daniel () ruoso com (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 08)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 09)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Josh Bressers (Jun 06)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Ludwig Nussel (Jun 10)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ludwig Nussel (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Luka Marinko (Jun 15)
- Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl) Ondrej Vasik (Jun 15)
- Re: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl Bernhard Rosenkraenzer (Jun 10)