Package: mingetty
Version: 1.07-1
Severity: critical
Tags: security patch
Hi,
mingetty doesn't change current directory after chroot() call.
It allows an attacker to call chdir("../") many times and get root directory.
Also chdir(), chroot() and nice() are not checked for error return values.
It allows an attacker to avoid local policy restriction in some cases.
-- System Information:
Debian Release: squeeze/sid
APT prefers lucid-updates
APT policy: (500, 'lucid-updates'), (500, 'lucid-security'), (500,
'lucid-proposed'), (500, 'lucid-backports'), (500, 'lucid')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-25-generic (SMP w/2 CPU cores)
Locale: LANG=ru_RU.utf8, LC_CTYPE=ru_RU.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages mingetty depends on:
ii libc6 2.11.1-0ubuntu7.3 Embedded GNU C Library: Shared lib
mingetty recommends no packages.
mingetty suggests no packages.
-- no debconf information
--- mingetty.c.orig 2010-09-19 07:51:59.000000000 +0000
+++ mingetty.c 2010-09-19 08:00:09.000000000 +0000
@@ -431,12 +431,20 @@ int main (int argc, char **argv)
while ((logname = get_logname ()) == 0)
/* do nothing */ ;
- if (ch_root)
- chroot (ch_root);
- if (ch_dir)
- chdir (ch_dir);
- if (priority)
- nice (priority);
+ if (ch_root) {
+ if (chroot (ch_root))
+ error ("chroot(): %s", strerror (errno));
+ if (chdir("/"))
+ error ("chdir(\"/\"): %s", strerror (errno));
+ }
+ if (ch_dir) {
+ if (chdir (ch_dir))
+ error ("chdir(): %s", strerror (errno));
+ }
+ if (priority) {
+ if (nice (priority))
+ error ("nice(): %s", strerror (errno));
+ }
execl (loginprog, loginprog, autologin? "-f" : "--", logname, NULL);
error ("%s: can't exec %s: %s", tty, loginprog, strerror (errno));
