getaddrinfo security problem ?

[Thorsten Kukuk <kukuk at suse dot de>]

Hi,

it looks like there is a problem with the getaddrinfo function
in glibc.

A lot of programs, which are IPv6 ready, do:

  memset(&hints, 0, sizeof (hints));
  hints.ai_family = PF_UNSPEC;
  hints.ai_socktype = SOCK_STREAM;

  error = getaddrinfo (host, "<service>", &hints, &res0);

For me it looks like this is correct. But if host is "localhost", we 
get back addresses for AF_INET, AF_INET6 and AF_UNIX.
If the daemon is not running, AF_INET and AF_INET6 fails and AF_UNIX
is used. AF_UNIX uses a fixed path "/tmp/<service>" !

And here is the problem: If the daemon is not running, a user can
start his own, faked daemon with the "/tmp/<service>" socket.

I don't know if it is correct to return AF_UNIX with a path in
/tmp. I think this is a very bad idea, and for me it looks like
glibc should not do this. I cannot find any other implementation
where AF_UNIX is returned, looks like only glibc is doing this.

Any other opiniums ? What does the standard say about this ?
I think we should disable it.

  Thorsten

-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE GmbH            Deutschherrnstr. 15-19          90429 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B