First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 247278
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Steven Susbauer <stupendoussteve@hotmail.com>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 247278 depends on: Show dependency tree
Bug 247278 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-11-17 22:04 0000 
Syslog-ng does not call chdir() before chroot() which may allow the application
to break out of a chroot jail.

CVE is new and has not yet been uploaded.

Ref: http://www.openwall.com/lists/oss-security/2008/11/17/3

------- Comment #1 From Tobias Heinlein 2009-05-22 19:00:54 0000 ------- 
Seems this bug has been overlooked for some time.

I just investigated this issue. Here are my results:

Debian's patch suggests using chdir(chroot_dir) and then chroot(chroot_dir).
The thread on openwall linked in comment #0, however, raises some concerns
about race conditions and suggests using either chdir(chroot_dir) and then
chroot("."), or chroot(chroot_dir) first and then chdir("/"). Upstream used the
latter approach and also solved all the other concerns raised in the openwall
thread.

This leads us to the fixed versions:
2.0.* until 2.0.9 is vulnerable, 2.0.10 is fixed.
2.1.* until 2.1.2 is vulnerable, 2.1.3 is fixed.

2.1.3 is already stable on all arches, so no stabilization needs to be done
here. Since the issue at hand is only exploitable with another separate
vulnerability, I don't think a GLSA is necessary. In fact, I wasn't even able
to find a detailed (upstream) advisory about this.

------- Comment #2 From Robert Buchholz 2009-07-10 11:11:22 0000 ------- 
not a vulnerability in itself, but this is a high profile daemon and bringing
visibility to this kind of vulnerability is a good thing.

------- Comment #3 From Robert Buchholz 2009-07-12 17:51:37 0000 ------- 
GLSA 200907-10
First Last Prev Next    No search results available      Search page      Enter new bug