From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <thecrux@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on sa.int.altlinux.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,
	DNS_FROM_OPENWHOIS,SPF_PASS autolearn=no version=3.2.5
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:received:date:from:to:subject
	:message-id:mail-followup-to:references:mime-version:content-type
	:content-disposition:content-transfer-encoding:in-reply-to
	:user-agent; bh=A9WjUEa5oy3pQiv2C+SUZNKWnmPvkwRopcFfpNhtN8A=;
	b=CP4BqimO5OHqQNte+QzKg1Ww3w7d2JkdKbbodBt07uAU3lnXVXO1NDY6+UgfkPsmU2
	9fNbUfRa9ItYsBwO02KVKOo/fpaSU9HqnUNx8IR6+cd+uvMWUnnc6T0xZzOI0mQslYv4
	uwy4cc4Awys3gFcHDaWOGojzkBbkOG4e4/Glw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=date:from:to:subject:message-id:mail-followup-to:references
	:mime-version:content-type:content-disposition
	:content-transfer-encoding:in-reply-to:user-agent;
	b=XztUhiPO9LIqgfbHBki/oPr5jVrklYSIHM25/cGz5SK7O1sjkgdLmY08XPl96WQFkZ
	ep+VOa7l+8gVoZkGrHM2Lh7DWkU0fvRVY5mIm8/wpiAIlOEvFL3ZtY6wtDdc8mDgKkik
	uX5IyreQ8+P2DDZIvGqUSBDJhUR7tZ6kp/lio=
Date: Mon, 18 Oct 2010 18:15:23 +0400
From: Vladimir Lettiev <thecrux@gmail.com>
To: ALT Linux Team development discussions <devel@lists.altlinux.org>
Message-ID: <20101018141523.GA24089@truecrux.org>
Mail-Followup-To: ALT Linux Team development discussions
	<devel@lists.altlinux.org>
References: <bug-24333-28@http.bugzilla.altlinux.org/>
	<20101016093420.CB03C178802F@bugzilla.altlinux.org>
	<20101016094235.GI21987@osdn.org.ua>
	<20101016094519.GO3983@belkar.wrar.name>
	<20101016114128.GC18052@altlinux.org>
	<20101018121449.GA23132@truecrux.org>
	<20101018132556.GG21987@osdn.org.ua>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20101018132556.GG21987@osdn.org.ua>
User-Agent: Mutt/1.5.20 (2009-06-14)
Subject: Re: [devel] CVE-2010-3847 on FD
X-BeenThere: devel@lists.altlinux.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: ALT Linux Team development discussions <devel@lists.altlinux.org>
List-Id: ALT Linux Team development discussions <devel.lists.altlinux.org>
List-Unsubscribe: <https://lists.altlinux.org/mailman/options/devel>,
	<mailto:devel-request@lists.altlinux.org?subject=unsubscribe>
List-Archive: <http://lists.altlinux.org/pipermail/devel>
List-Post: <mailto:devel@lists.altlinux.org>
List-Help: <mailto:devel-request@lists.altlinux.org?subject=help>
List-Subscribe: <https://lists.altlinux.org/mailman/listinfo/devel>,
	<mailto:devel-request@lists.altlinux.org?subject=subscribe>
X-List-Received-Date: Mon, 18 Oct 2010 14:15:40 -0000
Archived-At: <http://lore.altlinux.org/devel/20101018141523.GA24089@truecrux.org/>
List-Archive: <http://lore.altlinux.org/devel/>
List-Post: <mailto:devel@altlinux.org>

On Mon, Oct 18, 2010 at 04:25:56PM +0300, Michael Shigorin wrote:
> On Mon, Oct 18, 2010 at 04:14:49PM +0400, Vladimir Lettiev wrote:
> > > Скоро будет опубликован CVE-2010-3847, который в Owl и ALT Linux был
> > > исправлен в корне более 9 лет назад, однако апстрим отказался принять
> > > эти изменения.  Этот конкретный апстрим извращённо консервативен.
> > CVE-2010-3847 опубликовали на Full Disclosure:
> > http://seclists.org/fulldisclosure/2010/Oct/257 
> 
> Спасибо, Дима.

Некоторые пошли по другому пути: блокируют возможность использовать
технику, необходимую для exploit'а:

http://lwn.net/Articles/393012/

В частности опция SECURITY_YAMA_HARDLINKS=y не даёт создавать жёсткие
ссылки на объекты, на которые пользователь не имеет права чтения и записи

-- 
Vladimir Lettiev aka crux ✉ theCrux@gmail.com