bugtraq - Re: Lack of environment sanitization in the FreeBSD, OpenBSD, NetBSD dynamic loaders.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 23 Nov 2006 10:23:59 +0100
From: Casper.Dik@....COM
To: In Cognito <defend.the.world@...il.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Lack of environment sanitization in the FreeBSD, OpenBSD, NetBSD dynamic loaders. 

>A class of security vulnerabilities has resurfaced in the dynamic loaders
>of FreeBSD, OpenBSD, and NetBSD in the sanitization of environment
>variables for suid and sgid binaries.

In Solaris we have long felt that the dynamic linker should not touch the
environment; instead, the onus is on applications running setuid(0) and
starting subprocesses to strip the appropriate environment variable
(or better, set the environment to a sensible default)

Various bugs of this sort have been fixed in Solaris over the years, in
the set-uid programs.  It is just one of the things set-uid program writes
need to be aware of.

As a number of set-uid applications start programs as the user later on,
stripping such environment variables often has undesirably side-effects.

Casper