full-disclosure - DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon May 15 09:16:07 2006
From: aaacab at gmail.com (aCaB)
Subject: DMA[2006-0514a] - 'ClamAV freshclam incorrect
	privilege drop'

FYI

-------- Original Message --------
Subject: [Clamav-team] Next 'security' advisory
Date: Mon, 15 May 2006 09:47:28 +0200
From: Tomasz Kojm <tkojm@...mav.net>
To: ClamAV Security <clamav-security@...ts.clamav.net>


In this case, the author failed to understand that:

* freshclam cannot drop privileges before parsing the config file because
  it must first read the value of DatabaseOwner from freshclam.conf

* privilege dropping was added to make the sysadmin's life easier

* if one can run freshclam as root then one can always use --user=root
  to bypass the privilege dropping and thus that security advisory
  is not worth a pound

* instead of giving regular users root privileges to run freshclam,
  every sensible sysadmin will add them to a proper group in /etc/group
  so they can write to the ClamAV database directory (if he really wants
  that, of course)

I'm not subscribed to bugtraq but would appreciate if one could forward my
response.

Thanks,

-- 
   oo    .....         Tomasz Kojm <tkojm@...mav.net>
  (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
     \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
       //\   /\              Mon May 15 09:43:17 CEST 2006