Re: Examples of lost security when integrating (secure) SW

Magnus Therning wrote:

> I just had a discussion with my colleagues regarding problems with
> security in larger systems that are composed by combining
> modules/components that individually are secure. Both my gut and sources
> I have consulted says this is the case. However, I haven't been able to
> find any examples of when this has happened!
> 
> Bruce Schneier spends a few pages in Secrets & Lies on the subject,
> without offering any examples of what can happen. I seem to remember
> some talk on a conference (was it Usenix?) a few years ago__I never
> attended it but I read the abstract of the papers/talks--where a talk on
> security mentioned a case where the combination of two security features
> effectively cancelled each other.
> 
> Can anyone offer any more concrete examples, ideally not only academic
> ones?

An example where a security feature can reduce security:

On a system which implements the (draft) POSIX 1e capabilities
mechanism, if a root-owned process doesn't have CAP_SETUID, it may not
be able to change its effective UID to a less privileged UID.

IOW, capabilities mean that a process may have insufficient privileges
to reduce its privileges.

An actual vulnerability is documented in:

	http://ciac.llnl.gov/ciac/bulletins/k-064.shtml

However, this is at least partly due to an implementation error (the
setuid() call appears to succeed although the UID remains unchanged). 
OTOH, it used to be a safe assumption that setuid() would never fail
for a root-owned process.

-- 
Glynn Clements <[email protected]>