[12347] in bugtraq
Re: Fix for ssh-1.2.27 symlink/bind problem
daemon@ATHENA.MIT.EDU (Wietse Venema)
Tue Oct 26 16:02:35 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-Id: <19991025230501.34B8E45A7B@spike.porcupine.org>
Date: Mon, 25 Oct 1999 19:05:01 -0400
Reply-To: Wietse Venema <wietse@PORCUPINE.ORG>
From: Wietse Venema <wietse@PORCUPINE.ORG>
X-To: Markus Friedl <markus.friedl@informatik.uni-erlangen.de>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <19991026001902.A32511@folly.informatik.uni-erlangen.de> from
Markus Friedl at "Oct 26, 99 00:19:02 am"
Markus Friedl:
> On Wed, Oct 06, 1999 at 11:11:12AM -0400, Wietse Venema wrote:
> > This is the second SSH vulnerability involving bind() (the other
> > one involve port forwarding). They really ought to learn to perform
> > operations with the right privilege level.
> >
> > With a little tooling (such as set_eugid()) it is quite easy.
>
> please note, that ssh dropped support for uid-swapping beginning
> with version 1.2.13:
> in order to avoid leakage of the private hostkey (e.g. in core-dumps)
I was talking about seteuid(), which leaves real uid == 0, so that
the process remains protected against groping by unprivileged users.
What was that with core dumps again? Any program that has access
to secrets such as host keys should disable core dumps; not doing
so would be negligent.
Wietse
