Re: Security release for mod_wsgi (version 3.5)

[Tomas Hoger <thoger () redhat com>]

On Tue, 17 Jun 2014 22:39:49 +1000 Graham Dumpleton wrote:

> So just to be safe one could in all cases exit anyway, but I believe
> the possibility that these could cause an issue is extremely limited,
> with the only case being where the user provides a bad gid for #nnn
> to the 'group' option which did actually exceed some integer range
> which was actually enforced by the operating system being used. If
> they used an actual group name, which would be the typical case, they
> shouldn't be able to trigger a problem.

My concern was more about things that are outside your control and can
still cause set*id calls to fail even if you feed them with sane data.
Some of these include other errors that can be encountered inside
syscall (e.g. memory allocation issues), capability issues, or simply
having MAC system (think SELinux) policy denying id change.  Those were
mentioned here:

http://www.openwall.com/lists/oss-security/2011/08/11/6
http://www.openwall.com/lists/oss-security/2011/08/11/9

Of course, while none of these are known to offer such easily and widely
usable attack vector as RLIMIT_NPROC causing setuid failure, it seems
reasonable to fix all properly while at it.

-- 
Tomas Hoger / Red Hat Security Response Team