Author: glen Date: Fri Oct 19 10:18:50 2007 GMT Module: SOURCES Tag: AC-branch ---- Log message: - from util-linux-ng git
---- Files affected: SOURCES: util-linux-CVE-2007-5191.patch (NONE -> 1.1.2.1) (NEW) ---- Diffs: ================================================================ Index: SOURCES/util-linux-CVE-2007-5191.patch diff -u /dev/null SOURCES/util-linux-CVE-2007-5191.patch:1.1.2.1 --- /dev/null Fri Oct 19 12:18:50 2007 +++ SOURCES/util-linux-CVE-2007-5191.patch Fri Oct 19 12:18:45 2007 @@ -0,0 +1,52 @@ +From: Ludwig Nussel <[EMAIL PROTECTED]> +Date: Thu, 20 Sep 2007 12:57:20 +0000 (+0200) +Subject: mount: doesn't drop privileges properly when calling helpers +X-Git-Url: http://git.kernel.org/?p=utils%2Futil-linux-ng%2Futil-linux-ng.git;a=commitdiff_plain;h=ebbeb2c7ac1b00b6083905957837a271e80b187e + +mount: doesn't drop privileges properly when calling helpers + +{,u}mount calls setuid() and setgid() in the wrong order and doesn't checking +the return value of set{u,g}id(() when running helpers like mount.nfs. + +Signed-off-by: Ludwig Nussel <[EMAIL PROTECTED]> +Signed-off-by: Karel Zak <[EMAIL PROTECTED]> +--- + +diff --git a/mount/mount.c b/mount/mount.c +index 40699f3..5bc2b30 100644 +--- a/mount/mount.c ++++ b/mount/mount.c +@@ -634,8 +634,12 @@ check_special_mountprog(const char *spec, const char *node, const char *type, in + char *oo, *mountargs[10]; + int i = 0; + +- setuid(getuid()); +- setgid(getgid()); ++ if(setgid(getgid()) < 0) ++ die(EX_FAIL, _("mount: cannot set group id: %s"), strerror(errno)); ++ ++ if(setuid(getuid()) < 0) ++ die(EX_FAIL, _("mount: cannot set user id: %s"), strerror(errno)); ++ + oo = fix_opts_string (flags, extra_opts, NULL); + mountargs[i++] = mountprog; /* 1 */ + mountargs[i++] = (char *) spec; /* 2 */ +diff --git a/mount/umount.c b/mount/umount.c +index b3100c9..3221619 100644 +--- a/mount/umount.c ++++ b/mount/umount.c +@@ -102,8 +102,12 @@ check_special_umountprog(const char *spec, const char *node, + char *umountargs[8]; + int i = 0; + +- setuid(getuid()); +- setgid(getgid()); ++ if(setgid(getgid()) < 0) ++ die(EX_FAIL, _("umount: cannot set group id: %s"), strerror(errno)); ++ ++ if(setuid(getuid()) < 0) ++ die(EX_FAIL, _("umount: cannot set user id: %s"), strerror(errno)); ++ + umountargs[i++] = umountprog; + umountargs[i++] = xstrdup(node); + if (nomtab) ================================================================ _______________________________________________ pld-cvs-commit mailing list [email protected] http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit
