Date: Wed, 30 May 2001 15:31:47 -0400 From: "alexus" <ml@db.nexgen.com> To: "Rob Simmons" <rsimmons@wlcg.com> Cc: "Nick Cleaton" <nick@cleaton.net>, <security@FreeBSD.ORG> Subject: Re: 4.3 Security: local DoS via clean-tmps Message-ID: <005801c0e93f$2af71060$01000001@book> References: <Pine.BSF.4.21.0105251351250.62149-100000@mail.wlcg.com>
next in thread | previous in thread | raw e-mail | index | archive | help
ok then i'm calm:) ----- Original Message ----- From: "Rob Simmons" <rsimmons@wlcg.com> To: "alexus" <ml@db.nexgen.com> Cc: "Nick Cleaton" <nick@cleaton.net>; <security@FreeBSD.ORG> Sent: Friday, May 25, 2001 1:53 PM Subject: Re: 4.3 Security: local DoS via clean-tmps > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > That is off by default in FreeBSD. You would have had to add a line like > this to /etc/periodic.conf > > daily_clean_tmps_enable="YES" > > The line in /etc/defaults/periodic.conf is: > > daily_clean_tmps_enable="NO" > > Robert Simmons > Systems Administrator > http://www.wlcg.com/ > > On Fri, 25 May 2001, alexus wrote: > > > how can i make sure that i dont have this enabled? and if there a fix for > > that? > > > > ----- Original Message ----- > > From: "Nick Cleaton" <nick@cleaton.net> > > To: <security@freebsd.org> > > Sent: Friday, May 25, 2001 1:03 PM > > Subject: 4.3 Security: local DoS via clean-tmps > > > > > > > > > > Tested in 4.3-RELEASE only: > > > > > > If /etc/periodic/daily/clean-tmps is enabled, then it's possible > > > for any local user to trick it into calling unlink() or rmdir() > > > on anything in the root directory. > > > > > > The problem is that "find -delete" can be made to do chdir("..") > > > multiple times followed by unlink() and/or rmdir(). > > > > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL unlink(0x8051440) > > > 588 find NAMI "sys" > > > > > > This means it can be tricked into going up too high by moving > > > its current directory higher up the hierarchy, by for example > > > doing "mv /tmp/1/2/3 /tmp/4" while find's working directory is > > > somewhere under "/tmp/1/2/3". > > > > > > The attached exploit will cause it to delete the /home -> /usr/home > > > symlink. I think this would render it impossible to log into a > > > system configured for non-root ssh access via DSA key only. > > > > > > This could also be used to unlink other users' files in /tmp > > > without regard to their age. > > > > > > -- > > > Nick Cleaton > > > nick@cleaton.net > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.5 (FreeBSD) > Comment: For info see http://www.gnupg.org > > iD8DBQE7DpwSv8Bofna59hYRA3aIAJ40bgRrqBeUU/KwCEWoyECin3rNIQCfeWig > 3NZrJFVotoNfWFaMlUdTckA= > =+kjL > -----END PGP SIGNATURE----- > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005801c0e93f$2af71060$01000001>