This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: [PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal

From: Mike Frysinger <vapier at gentoo dot org>
To: libc-alpha at sourceware dot org
Cc: "Carlos O'Donell" <carlos at redhat dot com>, David Miller <davem at davemloft dot net>, Roland McGrath <roland at hack dot frob dot com>, Andreas Schwab <schwab at suse dot de>, Andreas Jaeger <aj at suse dot com>, "Joseph S. Myers" <joseph at codesourcery dot com>, Ryan Arnold <rsa at us dot ibm dot com>, Alexandre Oliva <aoliva at redhat dot com>, Siddhesh Poyarekar <siddhesh at redhat dot com>
Date: Sun, 25 Aug 2013 03:42:25 -0400
Subject: Re: [PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal
References: <51E8D4C1 dot 9000705 at redhat dot com>

On Friday 19 July 2013 01:55:13 Carlos O'Donell wrote:
> --- a/configure.in
> +++ b/configure.in
> @@ -353,6 +353,16 @@ AC_ARG_ENABLE([nscd],
>  	      [use_nscd=$enableval],
>  	      [use_nscd=yes])
> 
> +AC_ARG_ENABLE([pt_chown],
> +	      [AS_HELP_STRING([--enable-pt_chown],
> +	       [Enable building and installing pt_chown])],
> +	      [build_pt_chown=$enableval],
> +	      [build_pt_chown=no])
> +AC_SUBST(build_pt_chown)
> +if test $build_pt_chown = yes; then

the var expansion is missing quoting.  since it comes directly from the user, 
you could trigger bad behavior:
	./configure --enable-pt_chown='foo bar it'
-mike

Attachment: signature.asc
Description: This is a digitally signed message part.

Follow-Ups:
- Re: [PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal
  - From: Mike Frysinger

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]