[12363] in bugtraq
Re: Fix for ssh-1.2.27 symlink/bind problem
daemon@ATHENA.MIT.EDU (Wietse Venema)
Thu Oct 28 12:42:03 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-Id: <19991027223556.8299945AF6@spike.porcupine.org>
Date: Wed, 27 Oct 1999 18:35:56 -0400
Reply-To: Wietse Venema <wietse@PORCUPINE.ORG>
From: Wietse Venema <wietse@PORCUPINE.ORG>
X-To: Markus Friedl <markus.friedl@informatik.uni-erlangen.de>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <19991026215521.A30564@folly.informatik.uni-erlangen.de> from
Markus Friedl at "Oct 26, 99 09:55:21 pm"
Markus Friedl:
> Since Solaris 2.3 allowed you to attach (e.g. with gdb) to a
> programm running with euid==youruid, Tatu dropped the uid-swapping
> code and made ssh fork into two processes.
...
> void temporarily_use_uid(uid_t uid)
> {
> #ifdef SAVED_IDS_WORK_WITH_SETEUID
> saved_euid = geteuid();
> if (seteuid(uid) == -1)
> debug("seteuid %d: %.100s", (int)uid, strerror(errno));
> #else
ssh starts up with the unprivileged real UID of the user; therefore
setting the effective UID also to that of the user makes the process
memory accessible for unprivileged access. This is how any reasonable
UNIX system works, not just Solaris.
However, no reasonable UNIX system should allow unprivileged users
to debug a process that runs with real UID == 0, even when the
effective UID is that of the user. That is the point I have been
making repeatedly in this thread, and now I am tired of making it.
Wietse
