Re: nohup with stdout closed (was: Defect in XCU nohup)

[Gunnar Ritter <yyyyyyy@xxxxxxx>]

yyy@xxxxxxxxxxxxxxxxxxxxxxxx (James Youngman) wrote:

> It can be worse than this, too.  For example, 'ping' is set-user-id on
> many systems, and by this mechanism it can be persuaded to send
> arbitrary data of an attacker's choice out of its raw socket.  Hence
> the wording of execve() which I quote below.

The correct way to handle this problem is to fix that implementation
of the "ping" program, and to fix it _now_. A program that relies on
a "may" condition in the standard is not a secure one and should not
be run set-used-id anyway, regardless of possible future changes.

        Gunnar