From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: dkg@fifthhorseman.net Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id c2b603ca for ; Mon, 30 Oct 2017 12:14:19 +0000 (UTC) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 8979e93d for ; Mon, 30 Oct 2017 12:14:18 +0000 (UTC) From: Daniel Kahn Gillmor To: "Jason A. Donenfeld" Subject: Re: Fixing wg-quick's DNS= directive with a hatchet In-Reply-To: References: <3a761178-19bc-1d01-b6a8-9fb801312d47@solidadmin.com> <44ac12fe-685b-730e-8afd-e4081daf038d@solidadmin.com> <92b6b9c5-b07c-52fa-a72a-0fc2dcc253bc@solidadmin.com> <87she4fdol.fsf@fifthhorseman.net> <87ineze3x2.fsf@fifthhorseman.net> Date: Mon, 30 Oct 2017 13:16:22 +0100 Message-ID: <87inewde5l.fsf@fifthhorseman.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , --=-=-= Content-Type: text/plain On Sun 2017-10-29 23:06:31 +0100, Jason A. Donenfeld wrote: > By the way, the program you wrote introduces a trivial local privilege > escalation vulnerability into Debian, since not all available > providers of the resolvconf binary set PATH themselves. Always clear > environment variables yourself before exec'ing anything in an suid > executable. Thanks for this report, it should be fixed in resolvconf-admin 0.3. This is a bad failure in the filtering that resolvconf-admin is supposed to provide. I note that the privilege escalation vulnerability was for any code that would normally have been running as root anyway without resolvconf-admin -- so it leaves systems no worse than they'd been without resolvconf-admin (since no user is added to the resolvconf-admins group by default). But it's definitely a bad failure mode, given the design and intent of resolvconf-admin. I appreciate the catch! Please don't hesitate to report any other similar problems. Regards, --dkg --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOCdgUepHf6PklTkyFJitxsGSMjcFAln3GBcACgkQFJitxsGS MjeI8A//dGEwWZQMyBD5MMsGIFaw0e7BgaMWJy25UgqgCJzok/h5VocwviiH+0oY MDKANi7w5fTm/guN2OOBVViweypK0jI6S0pYQTuJNAbHUqWZbHI/0006NlVfgfa5 ceoBKyUw16z7Aq0rlQ4/CDuYO8BuwSBNNw6NJZUqr+5DNeFgp63sA0bhrQr9lC2O cbgr40F7yW1jUap3N2al461BeDpJGiUUb+watnMRKo8j3Y86jKUkiwuYRFqaoC6B 6OoFsUZJxg7k1ldjXh1v+oQGNDo2ZfQeG7iKJXgI7HoUpVgrsVwiYUSZvkOb0pQ/ uPCviL+xHNtW7tdEU3zAfeB2FH5aJRXlHCFoQsa0vUP4KGGwkehXwMMBavJOObBm eQKnD0xP0KK/wtQkT3DmPvYRTenv45UCJq2Hm0YVFEGWI/WsWeNsNa7c9g1LDGhv g2Vk8kwSK7WpXCIzXP7IdtGyyfKZPaFIcElCF/BZsUsUBo5YoYXUTRGSA/RuTnB+ pxsS5hY0k5wLqA199wXbVAcs+ZlUHh8KjDHEhJj0ylf5W1Um6XcORpsC8faG7L8W EHQM92k8I7dV7LSJnOAkAOW9gVKXlvL0Z2qt3/G4KHvCDWUZ+Famqb+rzd7mes+i R5iq2ZsDLxnvpR/mTDA8hXnu3w+Si8cM2LYh7UFPCV2mol+QFOQ= =HRoU -----END PGP SIGNATURE----- --=-=-=--