Opened 5 years ago
Last modified 4 years ago
#13466 new Bugs
Security vulnerability in Boost Interprocess
| Reported by: | Owned by: | Ion Gaztañaga | |
|---|---|---|---|
| Milestone: | To Be Determined | Component: | interprocess |
| Version: | Boost Development Trunk | Severity: | Problem |
| Keywords: | security windows DACL | Cc: |
Description
Greetings,
Our security team has flagged: if(SetSecurityDescriptorDacl(&sd, true, 0, false)) in interprocess\detail\win32_api.hpp as a "high-priority" vulnerability citing:
"Objects that have null DACLs can have their security descriptors altered by malicious users so that no one has access to the object. Even if everyone needs access to an object, the object should be secured so that only administrators can alter its security".
We've been told to bring this to your attention; Can you please let us know when it would be feasible to fix?
Note:
See TracTickets
for help on using tickets.
Bump?