Bug 805299 (CVE-2012-1187)

Summary:	CVE-2012-1187 bitlbee: does not drop extra group privileges
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	redhat-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-19 15:39:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	805301, 805302
Bug Blocks:

Description Vincent Danen 2012-03-20 20:15:27 UTC

It was reported [1] that Bitlbee did not drop group privileges correctly.  Bitlbee is supposed to drop privileges, but it simply calls setgid() followed by setuid() which is insufficient, as the extra groups the process was started with are still available.

This is corrected upstream [2] (although the changeset r856 includes some unrelated fixes as well; the patch to unix.c is the required fix).  Bitlbee 3.0.4 is affected.

[1] http://bugs.bitlbee.org/bitlbee/ticket/852
[2] http://bugs.bitlbee.org/bitlbee/changeset/devel%2C856#file3

Comment 1 Vincent Danen 2012-03-20 20:16:54 UTC

Created bitlbee tracking bugs for this issue

Affects: fedora-all [bug 805301]
Affects: epel-all [bug 805302]