Message-Id: <1132666781.3348.16.camel@dsp1>
Date: Tue, 22 Nov 2005 14:39:41 +0100
From: Silvere THOMMEREL <email address hidden>
To: Mike Hommey <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: Bug#340284: mozilla-firefox: "su root -c firefox" gives root
	access to any other firefox loaded.

Hi,=20
Thanx for your replies.
Ok then, It seems I over reacted for what seems to be a normal feature.
Did anybody ever try to list/document the programs which behave this
way ?

On the contrary launching firefox from within a "su" if there 's already
a firefox loaded is useless.

This bug case can be closed if it still depends on me.

Regards,

Le mardi 22 novembre 2005 =E0 13:21 +0100, Mike Hommey a =E9crit :
> severity 340284 normal
> merge 340284 238533
> thanks
>=20
> On Tue, Nov 22, 2005 at 12:36:46PM +0100, S. Thommerel <silvere.thommer=
<email address hidden>> wrote:
> > Package: mozilla-firefox
> > Version: 1.0.7-1
> > Severity: critical
> > Tags: security
> > Justification: root security hole
> >=20
> >=20
> >=20
> > To reproduce this bug:
> >=20
> >  su root and then load firefox from the term. Then launch firefox fro=
m
> >  another unrelated and normal user terminal. The newly launched firef=
ox reads root's
> >  profile and gets root's rights.
> >=20
> >  I normally have no rights to save anything in /usr/share with my use=
r
> >  account. I used firefox as root to go and grab an icon for xfce4 tha=
t I
> >  could save in /usr/share/pixmaps. After that the download tab was th=
e
> >  only remaining part of root's firefox.
> >  I loaded firefox (normal user account) and it didn't not show my nor=
mal
> >  homepage. I tried to save google's logo in /usr/share/pixmaps. It
> >  worked!!!
>=20
> You ran your firefox from the same display, thus using the one that was
> already on the display. It's a feature. It may be annoying, but not a
> security problem : if you have a root mozilla/firefox on your display,
> well, you already have root access.
> If you'd try on another display (Xnest or whatever), you'd see running
> firefox from there would bring a new instance.
>=20
> Downgrading severity, and merging with duplicates.
>=20
> Mike
> >=20
> > =20
> >=20
> > =20
> > -- System Information:
> > Debian Release: testing/unstable
> >   APT prefers testing
> >   APT policy: (500, 'testing')
> > Architecture: i386 (i686)
> > Shell:  /bin/sh linked to /bin/bash
> > Kernel: Linux 2.6.14
> > Locale: LANG=3DC, LC_CTYPE=3Dfr_FR (charmap=3DANSI_X3.4-1968) (ignore=
d: LC_ALL set to POSIX)
> >=20
> > Versions of packages mozilla-firefox depends on:
> > ii  debianutils               2.15.1         Miscellaneous utilities =
specific t
> > ii  fontconfig                2.3.2-1        generic font configurati=
on library
> > ii  libatk1.0-0               1.10.3-1       The ATK accessibility to=
olkit
> > ii  libc6                     2.3.5-6        GNU C Library: Shared li=
braries an
> > ii  libfontconfig1            2.3.2-1        generic font configurati=
on library
> > ii  libfreetype6              2.1.7-2.4      FreeType 2 font engine, =
shared lib
> > ii  libgcc1                   1:4.0.2-2      GCC support library
> > ii  libglib2.0-0              2.8.3-1        The GLib library of C ro=
utines
> > ii  libgtk2.0-0               2.6.10-1       The GTK+ graphical user =
interface=20
> > ii  libidl0                   0.8.5-1        library for parsing CORB=
A IDL file
> > ii  libjpeg62                 6b-10          The Independent JPEG Gro=
up's JPEG=20
> > ii  libkrb53                  1.3.6-5        MIT Kerberos runtime lib=
raries
> > ii  libpango1.0-0             1.8.2-3        Layout and rendering of =
internatio
> > ii  libpng12-0                1.2.8rel-5     PNG library - runtime
> > ii  libstdc++6                4.0.2-2        The GNU Standard C++ Lib=
rary v3
> > ii  libx11-6                  6.8.2.dfsg.1-7 X Window System protocol=
 client li
> > ii  libxext6                  6.8.2.dfsg.1-7 X Window System miscella=
neous exte
> > ii  libxft2                   2.1.7-1        FreeType-based font draw=
ing librar
> > ii  libxinerama1              6.8.2.dfsg.1-7 X Window System multi-he=
ad display
> > ii  libxp6                    6.8.2.dfsg.1-7 X Window System printing=
 extension
> > ii  libxt6                    6.8.2.dfsg.1-7 X Toolkit Intrinsics
> > ii  psmisc                    21.8-1         Utilities that use the p=
roc filesy
> > ii  xlibs                     6.8.2.dfsg.1-7 X Window System client l=
ibraries m
> > ii  zlib1g                    1:1.2.3-4      compression library - ru=
ntime
> >=20
> > mozilla-firefox recommends no packages.
> >=20
> > -- no debconf information
> >=20
> >=20
>=20