diff options
author | Patrick J Volkerding <volkerdi@slackware.com> | 2018-05-25 23:29:36 +0000 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2018-05-31 15:18:32 -0700 |
commit | 8ff4f2f51a6cf07fc33742ce3bee81328896e49b (patch) | |
tree | 4a166b8389404be98a6c098babaa444e2dec8f48 /patches/source/shadow/shadow.CVE-2005-4890.relax.diff | |
parent | 76fc4757ac91ac7947a01fb7b53dddf9a78a01d1 (diff) | |
download | current-14.1.tar.gz current-14.1.tar.xz |
Fri May 25 23:29:36 UTC 201814.1
patches/packages/glibc-zoneinfo-2018e-noarch-2_slack14.1.txz: Rebuilt.
Handle removal of US/Pacific-New timezone. If we see that the machine is
using this, it will be automatically switched to US/Pacific.
Diffstat (limited to 'patches/source/shadow/shadow.CVE-2005-4890.relax.diff')
-rw-r--r-- | patches/source/shadow/shadow.CVE-2005-4890.relax.diff | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/patches/source/shadow/shadow.CVE-2005-4890.relax.diff b/patches/source/shadow/shadow.CVE-2005-4890.relax.diff new file mode 100644 index 000000000..98425e16a --- /dev/null +++ b/patches/source/shadow/shadow.CVE-2005-4890.relax.diff @@ -0,0 +1,35 @@ +From 0f6a809b7c4c9a8f4adb5b25808dd68000e17aa2 Mon Sep 17 00:00:00 2001 +From: mancha <mancha1@hush.com> +Date: Wed, 04 Dec 2013 +Subject: restrict "su -c" only when callee is not root + +Shadow 4.1.5 addressed a tty-hijacking vulnerability in "su -c" +(CVE-2005-4890) by detaching the controlling terminal in the non-PAM +case via a TIOCNOTTY request. + +Bi-directional protection is excessive and breaks a commonly-used +methods for privilege escalation on non-PAM systems (e.g. xterm -e +/bin/su -s /bin/bash -c /bin/bash myscript). + +This patch relaxes the restriction and only detaches the controlling +tty when the callee is not root (which is, after all, the threat vector). + +--- + src/su.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/src/su.c ++++ b/src/su.c +@@ -1076,10 +1076,10 @@ int main (int argc, char **argv) + + set_environment (pw); + +- if (!doshell) { ++ if (!doshell && pw->pw_uid != 0) { + /* There is no need for a controlling terminal. + * This avoids the callee to inject commands on +- * the caller's tty. */ ++ * the caller's tty when the callee is not root. */ + int err = -1; + + #ifdef USE_PAM |