X-Recipient: archive-cygwin AT delorie DOT com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:reply-to:from:subject:to:message-id:date :mime-version:content-type:content-transfer-encoding; q=dns; s= default; b=LkfXRFUEQld4ijt4hQaFS1c6jj1oG8SFAoELcp0TBoKwcHyq1FqrF Hld4iOVY2ZcegOYssNqorQPHb9MS2jAYD/4aG30MLxuHS49EbW8WmrucXbKMdHMX 1ZcPwr6jRenNflzBhIXyoQzzJoNWVqc2rtUWt/FuFp/pEII7VW6I4s= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:reply-to:from:subject:to:message-id:date :mime-version:content-type:content-transfer-encoding; s=default; bh=9L8Apmwwkbrn5XktU2YdQsSe3uw=; b=fDmbRT/Cyhfxsqk6AanYNJQPDnik U6z7IBgu2kJfuD4pFuUQjQKzxjRwxhKTPMe8yc1UM08Luqj6KE124CS5bk3dbREY mNAZIXkknIyncIJjhMdhzWayBwy3RoCD81HMkv8Ak16qBFSoUOGBFZKoHIvMmVN7 HJ/DNNdI52xvI30= Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-HELO: localhost.localdomain Reply-To: cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-0.9 required=5.0 tests=BAYES_00,KAM_LAZY_DOMAIN_SECURITY,SPF_HELO_PASS autolearn=no version=3.3.2 spammy=H*MI:cygwin, H*M:cygwin, networks, shares From: Yaakov Selkowitz Subject: [ANNOUNCEMENT] CVE-2016-3067: network privilege escalation in Cygwin set(e)uid To: cygwin AT cygwin DOT com Message-Id: Date: Tue, 19 Apr 2016 14:37:10 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes In versions of Cygwin prior to 2.5.0, a process which switched user contexts on a system where neither the Cygwin LSA module was enabled, nor the user password stored thereon with 'passwd -R', would retain the network credentials of the original user context even after switching. In the case of system services, such as a user which logged into a Cygwin SSHD or a command run from a cronjob, this would allow access to networks shares to which the system service account (normally 'cyg_server', which is in the Administrators group) has access but to which the user would otherwise be denied. This issue was reported[1][2] by David Willis on 2016-Feb-08 and a fix committed[3] to the upstream repository by Corinna Vinschen on 2016-Feb-18. The fix was first included in the 2.5.0-0.4 test release on the same day[4] and in the 2.5.0-1 stable release which shipped[5] on 2016-Apr-11. Red Hat Product Security has assigned CVE-2016-3067 for this issue. [1] https://cygwin.com/ml/cygwin/2016-02/msg00101.html [2] https://cygwin.com/ml/cygwin/2016-02/msg00129.html and thread [3] https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=205862ed08649df8f50b926a2c58c963f571b044 [4] https://cygwin.com/ml/cygwin-announce/2016-02/msg00023.html [5] https://cygwin.com/ml/cygwin-announce/2016-04/msg00020.html -- Yaakov -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple