[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <f93002140605150115ydbe6831mfc6e9cac1cbec2c@mail.gmail.com>
Date: Mon May 15 09:16:07 2006
From: aaacab at gmail.com (aCaB)
Subject: DMA[2006-0514a] - 'ClamAV freshclam incorrect
privilege drop'
FYI
-------- Original Message --------
Subject: [Clamav-team] Next 'security' advisory
Date: Mon, 15 May 2006 09:47:28 +0200
From: Tomasz Kojm <tkojm@...mav.net>
To: ClamAV Security <clamav-security@...ts.clamav.net>
In this case, the author failed to understand that:
* freshclam cannot drop privileges before parsing the config file because
it must first read the value of DatabaseOwner from freshclam.conf
* privilege dropping was added to make the sysadmin's life easier
* if one can run freshclam as root then one can always use --user=root
to bypass the privilege dropping and thus that security advisory
is not worth a pound
* instead of giving regular users root privileges to run freshclam,
every sensible sysadmin will add them to a proper group in /etc/group
so they can write to the ClamAV database directory (if he really wants
that, of course)
I'm not subscribed to bugtraq but would appreciate if one could forward my
response.
Thanks,
--
oo ..... Tomasz Kojm <tkojm@...mav.net>
(\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg
\..........._ 0DCA5A08407D5288279DB43454822DC8985A444B
//\ /\ Mon May 15 09:43:17 CEST 2006
Powered by blists - more mailing lists