From owner-freebsd-security@FreeBSD.ORG  Thu Feb 26 14:53:36 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id F130816A4CE; Thu, 26 Feb 2004 14:53:35 -0800 (PST)
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 4742743D3F; Thu, 26 Feb 2004 14:53:35 -0800 (PST)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: from pobrecita.freebsd.ru (ache@localhost [127.0.0.1])
	by nagual.pp.ru (8.12.11/8.12.11) with ESMTP id i1QMpnrG073739;
	Fri, 27 Feb 2004 01:51:49 +0300 (MSK)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: (from ache@localhost)
	by pobrecita.freebsd.ru (8.12.11/8.12.11/Submit) id i1QMpnrg073738;
	Fri, 27 Feb 2004 01:51:49 +0300 (MSK)
	(envelope-from ache)
Date: Fri, 27 Feb 2004 01:51:49 +0300
From: Andrey Chernov <ache@nagual.pp.ru>
To: kientzle@acm.org
Message-ID: <20040226225149.GB73252@nagual.pp.ru>
Mail-Followup-To: Andrey Chernov <ache@nagual.pp.ru>,
	kientzle@acm.org, freebsd-security@FreeBSD.ORG, das@FreeBSD.ORG
References: <403CEF67.5040004@kientzle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <403CEF67.5040004@kientzle.com>
User-Agent: Mutt/1.5.6i
X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.24.0.5; VDF 6.24.0.20
cc: freebsd-security@FreeBSD.ORG
cc: das@FreeBSD.ORG
Subject: Re: Environment Poisoning and login -p
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Feb 2004 22:53:36 -0000

On Wed, Feb 25, 2004 at 10:54:31AM -0800, Tim Kientzle wrote:
> Possible fix:  Ignore "-p" flag if target shell is not
> in /etc/shells.  In this scenario, a nologin program would
> not be listed in /etc/shells, and thus such attacks would
> be blocked.

Please, no, -p functionality is there for reason.

> Possible fix:  Have login unconditionally discard LD_LIBRARY_PATH
> and LD_PRELOAD from the environment, even if "-p" is specified.

Yes! It is what I say from very beginning. It is so obvious that I wonder 
why others not see it first.

> Possible fix: Eliminate the "-p" option to login.

No.

-- 
Andrey Chernov | http://ache.pp.ru/