Menu
▾
▴
[ProFTPD-Devel] [Bug 451] New - setuid with lack of check (getuid)
|
From: <bu...@pr...> - 2001-02-01 00:23:47
|
http://bugs.proftpd.net/show_bug.cgi?id=451 *** shadow/451 Tue Jan 30 18:59:29 2001 --- shadow/451.tmp.1181 Tue Jan 30 18:59:29 2001 *************** *** 0 **** --- 1,40 ---- + +============================================================================+ + | setuid with lack of check (getuid) | + +----------------------------------------------------------------------------+ + | Bug #: 451 Product: ProFTPD | + | Status: NEW Version: 1.2.0pre10 | + | Resolution: Platform: All | + | Severity: minor OS/Version: Linux | + | Priority: P4 Component: core | + +----------------------------------------------------------------------------+ + | Assigned To: pro...@pr... | + | Reported By: bol...@dc... | + | CC list: Cc: | + +----------------------------------------------------------------------------+ + | URL: | + +============================================================================+ + | DESCRIPTION | + I used proftpd in the stable debian (i think 1.2.0pre10- + 2 ). + I tried it with rsbac (www.rsbac.de). If I don't give setuid right to + the + proftpd daemon, then the proftpd can't change it's uid to the user's + id. + + + So if proftpd can't change the uid to the user's id, then it leaves + his + own id as root. The login succeeded, and I was able to + download + /etc/shadow with a standard user's + rights. + + + It would be good, if proftpd checks if setuid was successfull or + not. + So after the setuid(id) do a getuid(id) and if it isn't the same, then + the + login is not successfull. Of course it isn't a real big problem, but + it + will be more + secure. \ No newline at end of file -- To unsubscribe, send mail to pro...@pr... with "unsubscribe" in the subject field of the message. http://www.proftpd.net -- The Official ProFTPD web site. http://bugs.proftpd.net -- Bug reporting and feature requests. |