Markus Friedl: > On Wed, Oct 06, 1999 at 11:11:12AM -0400, Wietse Venema wrote: > > This is the second SSH vulnerability involving bind() (the other > > one involve port forwarding). They really ought to learn to perform > > operations with the right privilege level. > > > > With a little tooling (such as set_eugid()) it is quite easy. > > please note, that ssh dropped support for uid-swapping beginning > with version 1.2.13: > in order to avoid leakage of the private hostkey (e.g. in core-dumps) I was talking about seteuid(), which leaves real uid == 0, so that the process remains protected against groping by unprivileged users. What was that with core dumps again? Any program that has access to secrets such as host keys should disable core dumps; not doing so would be negligent. Wietse
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:08:48 PDT