user/1819: Possible signal race in pppd(8)

[venglin@unia.3lo.lublin.pl]

>Number:         1819
>Category:       user
>Synopsis:       Possible signal race in pppd(8)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 11 14:20:02 MDT 2001
>Last-Modified:
>Originator:     Przemyslaw Frasunek
>Organization:
czuby.net
>Release:        OpenBSD 2.9-beta
>Environment:
	System      : OpenBSD 2.9
	Architecture: OpenBSD.i386
	Machine     : i386
>Description:

	Pppd(8) uses the same functions as signal handlers for SIGHUP
	and SIGINT:

	SIGNAL(SIGINT, term);
	SIGNAL(SIGTERM, term);

	and bad_signal() handler for other signals:

	SIGNAL(SIGABRT, bad_signal);
	SIGNAL(SIGALRM, bad_signal);
	SIGNAL(SIGFPE, bad_signal);
	[...]

	This opens a potential security hole, because term() and bad_signal()
	are using library functions and syscalls, which aren't reentrant safe.

	Pppd is suidroot on default system.

>How-To-Repeat:
	None. Theoretical vulnerability.
>Fix:
	Fix sighandlers.

>Audit-Trail:
>Unformatted: