bugJailkit - Bugs: bug #38079, [PATCH] Fix: environment variable...

 
 

bug #38079: [PATCH] Fix: environment variable checking

Submitted by:  Jiri Horky <jirihorky>
Submitted on:  Mon 14 Jan 2013 09:25:24 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 11 Apr 2013 08:59:18 AM UTC, comment #3:

thanks for the patch, the fix is committed to cvs
(and sorry for the late reply)

Olivier Sessink <oli4>
Project Administrator
Thu 17 Jan 2013 10:38:43 AM UTC, comment #2:

Hi,

after some more consideration, I think this issue is even more critical than it might seem from the beginning. If a user can set the LD_PRELOAD env. variable, he is effectively able to run any program he wants, making the jk_lsh useless.

Jiri Horky

Jiri Horky <jirihorky>
Mon 14 Jan 2013 09:29:58 AM UTC, comment #1:

Hi,

(sorry for the first message, I hit "return" accidentally).

When chrooting, jailkit deletes non-allowed environment variables. Unfortunately it does not refresh its index to the env array after deleting an element from it and thus it skips the next element of the deleted one, causing possible a security problem as the next element is never checked. The attached patch fixes this.

The patch was actually written by my colleague Lukas Hejtmanek.

Regards
Jiri Horky

Jiri Horky <jirihorky>
Mon 14 Jan 2013 09:25:24 AM UTC, original submission:

Hi,

current

Jiri Horky <jirihorky>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #27257:  jailkit-environ.patch added by jirihorky (569B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by oli4 (Posted a comment)
  • -unavailable- added by jirihorky (Submitted the item)
  • -unavailable- added by jirihorky
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Apr 2013 08:59:18 AM UTColi4StatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Mon 14 Jan 2013 09:25:24 AM UTCjirihorkyAttached File-=>Added jailkit-environ.patch, #27257
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1