Re: Re: CVE request: sudo TZ issue

[Florian Weimer <fweimer () redhat com>]

On 02/11/2015 06:59 AM, cve-assign () mitre org wrote:
> > http://www.sudo.ws/alerts/tz.html
>
> We are not sure why this is being interpreted as a vulnerability
> in sudo that should have a CVE assignment in which sudo is the 
> responsible product. It appears that you are adding a new security 
> feature in which sudo chooses to help prevent exploitation of bugs
> in a system library such as libc.

Changing environment variables is not compliant with the prevalent
interpretation of of POSIX, and as a result, at least glibc will not
change its behavior.  This means that AT_SECURE programs such as sudo
need to implement proper filtering.

I will obtain clarification from the Austin Group that scrubbing
environment variables in the implementation name space is allowed, and
then we can revisit this matter as far as glibc is concerned.

-- 
Florian Weimer / Red Hat Product Security