Re: [Full-disclosure] DMA[2006-0514a] - 'ClamAV freshclam incorrect privilege drop'

[aCaB <aaacab@xxxxxxxxx>]

FYI

-------- Original Message --------
Subject: [Clamav-team] Next 'security' advisory
Date: Mon, 15 May 2006 09:47:28 +0200
From: Tomasz Kojm <tkojm@xxxxxxxxxx>
To: ClamAV Security <clamav-security@xxxxxxxxxxxxxxxx>


In this case, the author failed to understand that:

* freshclam cannot drop privileges before parsing the config file because
 it must first read the value of DatabaseOwner from freshclam.conf

* privilege dropping was added to make the sysadmin's life easier

* if one can run freshclam as root then one can always use --user=root
 to bypass the privilege dropping and thus that security advisory
 is not worth a pound

* instead of giving regular users root privileges to run freshclam,
 every sensible sysadmin will add them to a proper group in /etc/group
 so they can write to the ClamAV database directory (if he really wants
 that, of course)

I'm not subscribed to bugtraq but would appreciate if one could forward my
response.

Thanks,

--
  oo    .....         Tomasz Kojm <tkojm@xxxxxxxxxx>
 (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
    \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
      //\   /\              Mon May 15 09:43:17 CEST 2006

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/