FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

doas -- Prevent passing of environment variables

Affected packages
doas < 6.1

Details

VuXML ID 7f7d6412-bae5-11e9-be92-3085a9a95629
Discovery 2019-08-03
Entry 2019-08-09
Modified 2019-08-15

Jesse Smith (upstream author of the doas program) reported:

Previous versions of "doas" transferred most environment variables, such as USER, HOME, and PATH from the original user to the target user. Passing these variables could cause files in the wrong path or home directory to be read (or written to), which resulted in potential security problems.

Many thanks to Sander Bos for reporting this issue and explaining how it can be exploited.

References

Message 2a5cda45ef35e885c9a8b1e@tedunangst.com
URL https://github.com/slicer69/doas/releases/tag/6.1