[18416] in bugtraq
Re: gtk+ security hole.
daemon@ATHENA.MIT.EDU (Robert van der Meulen)
Wed Jan 3 16:21:43 2001
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="sdtB3X0nJg68CQEu"
Content-Disposition: inline
Message-Id: <20010103174623.A22185@cistron.nl>
Date: Wed, 3 Jan 2001 17:46:23 +0100
Reply-To: Robert van der Meulen <rvdm@CISTRON.NL>
From: Robert van der Meulen <rvdm@CISTRON.NL>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <20010103020807.D1433@artemis.infodump.net>; from
kain@CHAOSIUM.NET on Wed, Jan 03, 2001 at 02:08:08AM -0600
--sdtB3X0nJg68CQEu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
Quoting Kain (kain@CHAOSIUM.NET):
> On Tue, Jan 02, 2001 at 04:13:58PM -0500, Rob Mosher wrote:
> > A simple fix to this would be to drop priveleges before calling
> > gtk_init(), another easy fix is to modify gtk itself, to do this you
> > need to make the following modification of gtkmain.c. In gtk-1.2.8 its
> > at approximately line 215, you have:
> IMO, the best way to fix this would be to have libglib/gtk see if euid=3D=
=3D0
> and just ignore those variables on init, and quite possibly go so far as
> to ignore "engine" lines in .gtkrcs or maybe filter them....
In the official reply of the gtk+ team, several, very valid, reasons are
given to _never_ have a suid/setgid gtk program.
If a gtk program is suid, the suidness is a security hole on itself.=20
I do not think gtk should be patched to behave differently when it's running
suid/setgid, as this will only encourage people to make suid/setgid gtk
programs, and we don't want that ;)
If there's bugs in the gtk libs they should (ofcourse) be patched, but
specific 'features' for evading problems occurring when running
setuid/setgid should IMHO not be implemented.
Just my $.02,=20
Robert
--=20
Linux Generation
Life is a sexually transmitted disease with 100% mortality.
--sdtB3X0nJg68CQEu
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE6U1dfFLJHZigagQ4RAoL4AKC0HL/sZXuZZbZdE7IEwLDcdxMKvACg2BQE
/j+5+IDGEMXaUU3RAd8n8HQ=
=8P5j
-----END PGP SIGNATURE-----
--sdtB3X0nJg68CQEu--
