bugGNU Screen - Bugs: bug #24454, Compiling from source installs...

 
 

bug #24454: Compiling from source installs suid root

Submitted by:  None
Submitted on:  Sun 05 Oct 2008 01:39:42 AM UTC  
 
Category: Build/InstallSeverity: 3 - Normal
Priority: 5 - NormalStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.0.3
Fixed Release: NonePlanned Release: None
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 05 Oct 2008 10:19:08 PM UTC, comment #2:

Hello Micah,

Thanks for the clarification. It makes sense that this should not be the default since it's possible to disable the multiuser functionality and have it still work. For example, Gentoo installs it sgid utmp. Slackware disables the multiuser functionality.

I guess this becomes a feature request that it should have some type of option to not install as suid. If that isn't acceptable, I'd request that it be put in the readme/install docs. It was a rather unpleasant shock when I noticed this.

Regards,
Joel R. Voss

Joel R. Voss <javantea>
Sun 05 Oct 2008 06:32:31 PM UTC, comment #1:

suid screen is required to support multiuser.

Note that the release is actually just Juergen and Micha's; I just uploaded it to GNU's FTP site (previously it was only available at the alternative site).

Note that your assertions about being able to read/write sensitive data don't generally apply; screen sets its uid appropriately before doing those things. OTOH, I personally have little confidence that there aren't a variety of buffer exploits that might be found in the areas that have to run as root. Use at your own risk.

Micah Cowan <micahcowan>
Sun 05 Oct 2008 01:39:42 AM UTC, original submission:

This is a security issue, not immediately exploitable, but opens up a ton of security vulnerabilities (reading/writing protected data).

My configure command was:
./configure --prefix=/usr/local/

jvoss@localhost$ su -c 'make install':

<snip>
chown root /usr/local//bin/screen-4.0.3 && chmod 4755 /usr/local//bin/screen-4.0.3
<snip>

jvoss@localhost$ grep 4755 *
Makefile: -chown root $(DESTDIR)$(bindir)/$(SCREEN) && chmod 4755 $(DESTDIR)$(bindir)/$(SCREEN)
Makefile.in: -chown root $(DESTDIR)$(bindir)/$(SCREEN) && chmod 4755 $(DESTDIR)$(bindir)/$(SCREEN)

Please explain why this is and how this can be fixed quickly. I checked and this version is GPG signed by "Micah Cowan <micahcowan@ubuntu.com>".

Thanks,
Joel R. Voss

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by javantea (Posted a comment)
  • -unavailable- added by micahcowan (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 15 Jan 2009 10:53:28 PM UTCmicahcowanOpen/ClosedOpen=>Closed
    Sun 05 Oct 2008 06:32:31 PM UTCmicahcowanStatusNone=>Invalid

    Back to the top


    Powered by Savane 3.1-cleanup1