[MPlayer-users] Setuid root mplayer

[D Richard Felker III]

On Wed, Aug 28, 2002 at 01:14:57PM -0300, Alejandro Néstor Vargas wrote:
> [Automatic answer: RTFM (read DOCS, FAQ), also read DOCS/bugreports.html]
> Davide Decicco dijo:
> > [Automatic answer: RTFM (read DOCS, FAQ), also read
> > DOCS/bugreports.html] Is someone able to explain me (or point me to
> > some useful resource on the web) why setuid root mplayer is a security
> > risk ? How can one gain root privileges through it ?
> 
> A totally bug-free program never is a security risk, but it is difficult
> to assure you a program is bug-free. This is why open source programs are
> more secure: because you can check yurself. But if you don't want to check
> all the software or you are not sure if you checked all the posibilities,
> always is a good precaution not to use the root user and not to use setuid
> programs... It depends on how paranoid is one.

That's not the issue. It has nothing to do with bugs, but rather
design. MPlayer is not intended to run suid and restrict the actions
of the person invoking it. It's designed with the assumption that the
uid it's running as is the user on whose behalf it's running. Saying
mplayer is insecure because of this is as stupid as saying "cat" is
insecure. Of course if cat is suid-root you can cat /etc/shadow!!

Now, mplayer probably *is* insecure in that a maliciously crafted
movie can cause it to execute arbitrary code. At some point such
issues should be identified and addressed, but that's another matter
entirely.

Rich