DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:content-type; q=dns; s=default; b=FB
	tID6PxnZ506hbqSrfA4MGLiVJFihZ8/Q7RTv3nE48130AU3tBoCgvtWGqdsQTjHk
	cTXAj3zRDXd8bp83lBXzod8z6QBLwRggHIx3HF96iwLoz9YYNAkHJqg/JYsBxGJ1
	9YYU3TtJcovy6UgHxb/VIc0lTxeerUD+FXHtlqbP4=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
In-Reply-To: <019c01d163bc$fe2fc500$fa8f4f00$@comcast.net>
References: <019c01d163bc$fe2fc500$fa8f4f00$@comcast.net>
Date: Tue, 9 Feb 2016 21:57:19 -0700
Message-ID: <CANnLRdhVrFcveO_jKb3_x=44WMJNO33DPnsJZ12Wus3U7Wo_fQ@mail.gmail.com>
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?
From: Stephen John Smoogen <smooge@gmail.com>
To: cygwin@cygwin.com
Content-Type: text/plain; charset=UTF-8

On 9 February 2016 at 21:39, David Willis <david_willis@comcast.net> wrote:
> Just to add an update to this, it appears that processes run from the shell
> while logged into the CYGWIN SSHD server are run as the correct user - i.e.
> I run a ping or cat a file and pipe it to less, and check Task Manager on
> the SSHD server, and those processes show as being run as the user I SSH'd
> in as, the way it should be.
>
> So it looks like this bug is specifically when accessing files or directory
> contents. I literally run a "ls -l" command from the local CYGWIN shell on
> the SSHD server, against a file share that I have no access to, and get a
> permission denied. I run the exact same command, SSH'd into that same box as
> the same user against the same file share, and this time I can list the
> directory contents. Same results with "cat"ing files in those directories.
> What gives?
>
> Any help on this VERY much appreciated!!!
>

In general, you need to be able to cut and paste the errors you are
seeing versus using words to describe them. There are several
different things that what you are describing could look like so
without that extra data it is hard to figure out how to duplicate what
you might be seeing.

-- 
Stephen J Smoogen.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple