| Main Archive Page > Month Archives > oss-security archives |
[oss-security] Multiple libraries privilege checking
From: Sebastian Krahmer <krahmer_at_nospam>Date: Mon May 16 2011 - 14:27:41 GMT
To: oss-security@lists.openwall.com
Hi,
Its probably about time to review libraries that are commonly
linked to (formerly-) suid programs, such as
libldap, libssl etc. In near future, in the advent of file caps
they are often lacking proper checks.
They usually just compare uid against euid (not even gid sometimes)
and do not check the dumpable flag or AT_SECURE (dont know whether
glibc exports a proper function to easily check that at all).
The libraries that I had a quick look at and which were found
"vulnerable" are:
- openssl-1.0.0c
- openldap-2.4.23
- cyrus-sasl-2.1.23
which is probably far from complete. Even if not linked directly to
a privileged running program, these libraries may be introduced by
plugins or frameworks (pam etc).
As a result, attackers may specify plugin directories or rouge directory
services for authentication as these libraries think they are
running unprivileged.
So better to fix them now than to be sorry in one year when they are going
to be used the fscaps-way.
Sebastian
-- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@suse.de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany