[Secure-testing-team] Bug#597382: unsafe chroot() call

[Vasiliy Kulikov]

Package: mingetty
Version: 1.07-1
Severity: critical
Tags: security patch

Hi,

mingetty doesn't change current directory after chroot() call.
It allows an attacker to call chdir("../") many times and get root directory.
Also chdir(), chroot() and nice() are not checked for error return values.
It allows an attacker to avoid local policy restriction in some cases.


-- System Information:
Debian Release: squeeze/sid
  APT prefers lucid-updates
  APT policy: (500, 'lucid-updates'), (500, 'lucid-security'), (500, 'lucid-proposed'), (500, 'lucid-backports'), (500, 'lucid')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-25-generic (SMP w/2 CPU cores)
Locale: LANG=ru_RU.utf8, LC_CTYPE=ru_RU.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages mingetty depends on:
ii  libc6                  2.11.1-0ubuntu7.3 Embedded GNU C Library: Shared lib

mingetty recommends no packages.

mingetty suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: diff
Type: text/x-c
Size: 816 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20100919/ce7bf36b/attachment.bin>