DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:references:in-reply-to:subject:date
	:message-id:mime-version:content-type:content-transfer-encoding;
	 q=dns; s=default; b=IXryc9qt12zAw7Dw6P0Uf+8/h+kx/NAuLiWhYMS+WJk
	7sIsS2Yah5sJR99YpBYHQlZ/Ld6ouYOBzAc4ud+TbxaAJbs9XBJuqdQ/LH7cs+Lb
	1OWHdlNzsAKZHn/5Cdj7YZ9WeZod57ZRykS17LD1uFjBRjF3qz72juih8H7AD0Yg
	=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: "David Willis" <david_willis@comcast.net>
To: <cygwin@cygwin.com>
References: <019c01d163bc$fe2fc500$fa8f4f00$@comcast.net>	<CANnLRdhVrFcveO_jKb3_x=44WMJNO33DPnsJZ12Wus3U7Wo_fQ@mail.gmail.com>	<019e01d163c2$d678c7e0$836a57a0$@comcast.net> <CACoZoo3ZQm03ZKiJEisZW+H+y-woPP9j-huBwT+wSpjUAkKJYQ@mail.gmail.com>
In-Reply-To: <CACoZoo3ZQm03ZKiJEisZW+H+y-woPP9j-huBwT+wSpjUAkKJYQ@mail.gmail.com>
Subject: RE: Possible Security Hole in SSHD w/ CYGWIN?
Date: Sat, 13 Feb 2016 12:04:53 -0800
Message-ID: <023e01d16699$cdac5df0$690519d0$@comcast.net>
MIME-Version: 1.0
Content-Type: text/plain;	charset="utf-8"
Content-Transfer-Encoding: 8bit

Thanks for taking the time to reproduce this - so now I know its not just me :) And to your point about connecting with a local path vs. a network path, I noticed that too - permissions are correct when accessing anything locally, but when accessing via a network path (even if it is to your own machine), will reproduce this issue.

Can any developers weigh in as to where the core of the problem might lie and/or how it would possibly be fixed?

Thanks,

David

-----Original Message-----
From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com] On Behalf Of Erik Soderquist
Sent: Friday, February 12, 2016 5:04 PM
To: cygwin@cygwin.com
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?

With the precise steps listed/demonstrated, I've reproduced it

I connected with ssh as a normal user using a private key, and cd'd to
//server/c$/ successfully, and in the Windows active sessions, it does
indeed show "cyg_server" as the connected user, not the user I logged
in with.  Trying this using a password rather than a private key
behaves as expected.

Taking this a step further, I created a new directory from Windows
Explorer and reset the permissions to explicitly deny access to the
normal user I tested with.  Then I tried to cd to
/cygdrive/c/access_denied_test/ and received the expected access
denied message, but when I tried to cd to
//server/c$/access_denied_test/ I succeeded, and was able to create
new files in the directory.

I can provide screen shots of the reproduction without the need to
redact quite so much.

-- Erik


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple