oss-sec mailing list archives
Re: Re: CVE request: sudo TZ issue
From: Rich Felker <dalias () libc org>
Date: Fri, 13 Feb 2015 02:05:05 -0500
On Wed, Feb 11, 2015 at 10:20:03AM -0700, Todd C. Miller wrote:
Depending on how other code is written, a TZ value could still be malicious even if it doesn't satisfy the definition of "unsafe" that you included. Should there be other CVEs for sudo if any such code is identified?There are really two issues here: exposure of TZ parsing bugs and access to arbitrary (potentially user-controlled) files. I'm happy to put the blame for TZ parsing bugs on libc or the application. However, there is no real way for the application to tell that it is being run by an unpriviliged user and that operations that would otherwise be safe (opening a user-specified time zone file) may be dangerous.
Why does sudo run the target program with both effective and real ids set to root? Why not run with only the effective uid set to root? Then the program would know that it's being run by an unprivileged user with elevated privileges (and its libc would restrict or ignore environment variables for internal libc use). Does such invocation break too many programs? Rich
Current thread:
- CVE request: sudo TZ issue Todd C. Miller (Feb 09)
- <Possible follow-ups>
- Re: CVE request: sudo TZ issue Florian Weimer (Feb 10)
- Re: CVE request: sudo TZ issue Todd C. Miller (Feb 10)
- Re: CVE request: sudo TZ issue cve-assign (Feb 10)
- Re: Re: CVE request: sudo TZ issue Florian Weimer (Feb 11)
- Re: CVE request: sudo TZ issue cve-assign (Feb 12)
- Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 11)
- Re: Re: CVE request: sudo TZ issue Rich Felker (Feb 12)
- Re: Re: CVE request: sudo TZ issue Simon McVittie (Feb 13)
- Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 13)