OpenE2K/glibc
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
e4608715e6
glibc/manual
History
Carlos O'Donell e4608715e6 CVE-2013-2207, BZ #15755: Disable pt_chown. 
The helper binary pt_chown tricked into granting access to another
user's pseudo-terminal.

Pre-conditions for the attack:

 * Attacker with local user account
 * Kernel with FUSE support
 * "user_allow_other" in /etc/fuse.conf
 * Victim with allocated slave in /dev/pts

Using the setuid installed pt_chown and a weak check on whether a file
descriptor is a tty, an attacker could fake a pty check using FUSE and
trick pt_chown to grant ownership of a pty descriptor that the current
user does not own.  It cannot access /dev/pts/ptmx however.

In most modern distributions pt_chown is not needed because devpts
is enabled by default. The fix for this CVE is to disable building
and using pt_chown by default. We still provide a configure option
to enable hte use of pt_chown but distributions do so at their own
risk.
2013-07-21 15:39:55 -04:00
..
examples Fix PF_LOCAL socket example sockaddr_un size calculation. 2013-02-08 14:55:50 -08:00
argp.texi Move node Argp Helper Functions to follow Argp Parsing State 2012-12-11 09:02:37 +05:30
arith.texi Doc fix for 'frexp' in arith.texi 2013-05-28 17:20:24 -04:00
charset.texi BZ#14336: Manual spelling fixes. 2012-07-09 04:41:13 -07:00
conf.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
contrib.texi Fix AArch64 typo. 2012-12-18 09:51:55 +00:00
creature.texi Remove NOTES. 2012-03-21 16:56:28 +00:00
crypt.texi Use Texinfo macros to refer to the GNU C Library within the manual. 2012-02-28 14:44:20 +00:00
ctype.texi Use Texinfo macros to refer to the GNU C Library within the manual. 2012-02-28 14:44:20 +00:00
debug.texi Add nptl manual chapter 2013-03-14 12:37:42 +05:30
dir .. 2005-11-21 15:45:19 +00:00
errno.texi [BZ #14256] 2013-05-30 05:51:22 -06:00
fdl-1.3.texi BZ#13738: Switch manual to FDL 1.3. 2012-02-24 12:58:10 -08:00
filesys.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
freemanuals.texi
getopt.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
header.texi Use Texinfo macros to refer to the GNU C Library within the manual. 2012-02-28 14:44:20 +00:00
install.texi CVE-2013-2207, BZ #15755: Disable pt_chown. 2013-07-21 15:39:55 -04:00
intro.texi Remove NOTES. 2012-03-21 16:56:28 +00:00
io.texi Clean up glibc manual references to "GNU system" (bug 6911). 2012-03-08 01:27:38 +00:00
job.texi Clean up glibc manual references to "GNU system" (bug 6911). 2012-03-08 01:27:38 +00:00
lang.texi Document va_copy in preference to __va_copy. 2012-07-20 23:49:24 +00:00
lgpl-2.1.texi Use canonical FSF .texi files for LGPL and FDL texts. 2011-06-06 16:16:55 -07:00
libc-texinfo.sh Add @detailmenu to subsection node listing 2013-02-24 21:05:58 +10:00
libc.texinfo Update miscellaneous copyright dates. 2013-01-02 19:43:40 +00:00
libcbook.texi
libm-err-tab.pl Remove trailing whitespace. 2013-06-05 20:44:03 +00:00
llio.texi BZ#15361: Make aio_fsync not check open modes. 2013-04-12 13:11:20 -07:00
locale.texi Use Texinfo macros to refer to the GNU C Library within the manual. 2012-02-28 14:44:20 +00:00
macros.texi Clean up glibc manual references to "GNU system" (bug 6911). 2012-03-08 01:27:38 +00:00
maint.texi [BZ #157] Remove include/stub-tag.h for good. 2012-11-04 19:59:40 +01:00
Makefile Rename nptl.texi to threads.texi 2013-03-19 14:28:20 +05:30
math.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
memory.texi manual: Sort mallopt M_* parameters alphabetically 2013-03-17 16:03:02 -04:00
message.texi manual/message.texi: Fix english and clarify. 2013-05-07 12:33:44 -04:00
nss.texi manual: Remove frobnicate @pxref. 2013-02-20 13:30:23 -05:00
nsswitch.texi
pattern.texi manual: glob flags: fix sorting order 2013-01-13 13:24:28 -05:00
pipe.texi Clean up glibc manual references to "GNU system" (bug 6911). 2012-03-08 01:27:38 +00:00
platform.texi * manual/platform.texi: Add missing @end deftypefun. 2013-05-26 18:06:30 +02:00
process.texi Clean up glibc manual references to "GNU system" (bug 6911). 2012-03-08 01:27:38 +00:00
resource.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
search.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
setjmp.texi setcontext: Clarify termination when uc_link is the null pointer. 2012-07-17 10:05:55 +02:00
signal.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
socket.texi Fix menu ordering in socket.texi. 2013-02-24 21:06:00 +10:00
startup.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
stdio-fp.c
stdio.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
string.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
summary.awk Update copyright notices with scripts/update-copyrights. 2013-01-02 19:05:09 +00:00
sysinfo.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
syslog.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
terminal.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
texinfo.tex Update texinfo.tex. 2013-06-25 17:21:48 +00:00
texis.awk
threads.texi Add documentation for default pthread attribute functions 2013-06-15 12:27:41 +05:30
time.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
tsort.awk Update copyright notices with scripts/update-copyrights. 2013-01-02 19:05:09 +00:00
users.texi Fix some errors in declarations in the manual. 2013-02-11 14:16:43 -08:00
xtract-typefun.awk * manual/xtract-typefun.awk: Swallow [(){}*] from function names. 2003-11-12 00:50:03 +00:00