Subject: Re: bin/2646: eeprom: another insecure kvm program
To: None <kashmir@umiacs.UMD.EDU>
From: Gordon W. Ross <gwr@mc.com>
List: netbsd-bugs
Date: 07/23/1996 11:40:35
What about the sun3? (The fix is in an #ifdef sparc section.)
> Date: Sat, 20 Jul 1996 17:28:35 -0400 (EDT)
> From: Mike Grupenhoff <kashmir@vanquish.umiacs.umd.edu>
...
> >Number: 2646
> >Category: bin
> >Synopsis: eeprom: another insecure kvm program
...
> >Description:
> /usr/sbin/eeprom is another kvm prog that doesn't discard setgid
> perms when an alternate kernel is specified.
> >How-To-Repeat:
> eeprom -N bogus_kernel .....
> >Fix:
> patch for /usr/src/usr.sbin/eeprom/main.c:
> #ifdef __sparc__
> + /*
> + * Discard setgid privileges if not the running kernel so that bad
> + * guys can't print interesting stuff from kernel memory.
> + */
> + if (system != NULL)
> + setgid(getgid());
> if (getcputype() != CPU_SUN4)
> use_openprom = 1;
> #endif /* __sparc__ */