[PATCH] BZ #15755: CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal

[Carlos O'Donell]

On 07/19/2013 12:41 PM, Joseph S. Myers wrote:
> On Fri, 19 Jul 2013, Carlos O'Donell wrote:
> 
>> NEWS
>>
>> * CVE-2013-2207 Granting access to another user's pseudo-terminal
>>   has been fixed by disabling pt_chown (Bugzilla #15755).
> 
> I think the NEWS entry should refer to the new configure option as well.
> 

I've checked in the fix and the following NEWS entry:

* CVE-2013-2207 Incorrectly granting access to another user's pseudo-terminal
  has been fixed by disabling the use of pt_chown (Bugzilla #15755).
  Distributions can re-enable building and using pt_chown via the new configure
  option `--enable-pt_chown'.  Enabling the use of pt_chown carries with it
  considerable security risks and should only be used if the distribution
  understands and accepts the risks.

Cheers,
Carlos.