Bug 693824 (CVE-2011-1496) - CVE-2011-1496 tmux does not drop group tmux privileges properly
Summary: CVE-2011-1496 tmux does not drop group tmux privileges properly
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2011-1496
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 694563 694564
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-04-05 16:31 UTC by Vincent Danen
Modified: 2019-09-29 12:44 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-11-01 10:50:03 UTC
Embargoed:

Attachments (Terms of Use)
updated patch from Debian (tmux_1.4-6) (850 bytes, patch)
2011-04-05 16:31 UTC, Vincent Danen 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Debian BTS 620304 0 None None None Never

Description Vincent Danen 2011-04-05 16:31:33 UTC 
Created attachment 490029 [details]
updated patch from Debian (tmux_1.4-6)

A Debian bug report [1] noted that tmux did not drop group privileges properly.  On Debian this is a bit of a security risk as tmux seems to be sgid utmp, but on Fedora it is sgid tmux.  In the interest of correcting the behaviour, I'm filing this bug but not as a security bug.  This also would affect tmux in EPEL.

To reproduce:

% SHELL="/bin/dash" tmux -S my_socket
$ id
uid=1001(vdanen) gid=1001(vdanen) egid=482(tmux) groups=1001(vdanen) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023


Debian has corrected it with an updated patch (attached).

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=620304
Comment 1 Vincent Danen 2011-04-07 16:19:01 UTC 
This has been assigned the CVE name CVE-2011-1496, so we have to treat it as a security flaw now.
Comment 2 Vincent Danen 2011-04-07 16:23:01 UTC 
Created tmux tracking bugs for this issue

Affects: fedora-all [bug 694563]
Affects: epel-all [bug 694564]
Note You need to log in before you can comment on or make changes to this bug.