Hi, Thanx for your replies. Ok then, It seems I over reacted for what seems to be a normal feature. Did anybody ever try to list/document the programs which behave this way ?
On the contrary launching firefox from within a "su" if there 's already a firefox loaded is useless. This bug case can be closed if it still depends on me. Regards, Le mardi 22 novembre 2005 à 13:21 +0100, Mike Hommey a écrit : > severity 340284 normal > merge 340284 238533 > thanks > > On Tue, Nov 22, 2005 at 12:36:46PM +0100, S. Thommerel <[EMAIL PROTECTED]> > wrote: > > Package: mozilla-firefox > > Version: 1.0.7-1 > > Severity: critical > > Tags: security > > Justification: root security hole > > > > > > > > To reproduce this bug: > > > > su root and then load firefox from the term. Then launch firefox from > > another unrelated and normal user terminal. The newly launched firefox > > reads root's > > profile and gets root's rights. > > > > I normally have no rights to save anything in /usr/share with my user > > account. I used firefox as root to go and grab an icon for xfce4 that I > > could save in /usr/share/pixmaps. After that the download tab was the > > only remaining part of root's firefox. > > I loaded firefox (normal user account) and it didn't not show my normal > > homepage. I tried to save google's logo in /usr/share/pixmaps. It > > worked!!! > > You ran your firefox from the same display, thus using the one that was > already on the display. It's a feature. It may be annoying, but not a > security problem : if you have a root mozilla/firefox on your display, > well, you already have root access. > If you'd try on another display (Xnest or whatever), you'd see running > firefox from there would bring a new instance. > > Downgrading severity, and merging with duplicates. > > Mike > > > > > > > > > > -- System Information: > > Debian Release: testing/unstable > > APT prefers testing > > APT policy: (500, 'testing') > > Architecture: i386 (i686) > > Shell: /bin/sh linked to /bin/bash > > Kernel: Linux 2.6.14 > > Locale: LANG=C, LC_CTYPE=fr_FR (charmap=ANSI_X3.4-1968) (ignored: LC_ALL > > set to POSIX) > > > > Versions of packages mozilla-firefox depends on: > > ii debianutils 2.15.1 Miscellaneous utilities > > specific t > > ii fontconfig 2.3.2-1 generic font configuration > > library > > ii libatk1.0-0 1.10.3-1 The ATK accessibility toolkit > > ii libc6 2.3.5-6 GNU C Library: Shared > > libraries an > > ii libfontconfig1 2.3.2-1 generic font configuration > > library > > ii libfreetype6 2.1.7-2.4 FreeType 2 font engine, shared > > lib > > ii libgcc1 1:4.0.2-2 GCC support library > > ii libglib2.0-0 2.8.3-1 The GLib library of C routines > > ii libgtk2.0-0 2.6.10-1 The GTK+ graphical user > > interface > > ii libidl0 0.8.5-1 library for parsing CORBA IDL > > file > > ii libjpeg62 6b-10 The Independent JPEG Group's > > JPEG > > ii libkrb53 1.3.6-5 MIT Kerberos runtime libraries > > ii libpango1.0-0 1.8.2-3 Layout and rendering of > > internatio > > ii libpng12-0 1.2.8rel-5 PNG library - runtime > > ii libstdc++6 4.0.2-2 The GNU Standard C++ Library v3 > > ii libx11-6 6.8.2.dfsg.1-7 X Window System protocol > > client li > > ii libxext6 6.8.2.dfsg.1-7 X Window System miscellaneous > > exte > > ii libxft2 2.1.7-1 FreeType-based font drawing > > librar > > ii libxinerama1 6.8.2.dfsg.1-7 X Window System multi-head > > display > > ii libxp6 6.8.2.dfsg.1-7 X Window System printing > > extension > > ii libxt6 6.8.2.dfsg.1-7 X Toolkit Intrinsics > > ii psmisc 21.8-1 Utilities that use the proc > > filesy > > ii xlibs 6.8.2.dfsg.1-7 X Window System client > > libraries m > > ii zlib1g 1:1.2.3-4 compression library - runtime > > > > mozilla-firefox recommends no packages. > > > > -- no debconf information > > > > >
