Megyer Ur wrote: > /usr/bin/man is a simple binary, without any suid bit, BUT > /usr/lib/man-db/man is suid man, and it's vulnerable to man -l <formatstr> > attack. So anyone can get man uid by exploiting it. > > So we can overwrite the /usr/lib/man-db/man binary with any stuff we > want, and when some user launches man, our code will be run instead of > the original /usr/lib/man-db/man binary. This is the real security > problem. Do "chattr +i /usr/lib/man-db/man*" to prevent this style attacks. Cheers, Foldi Ur ;) . . _ __ ______________________________________________________ __ _ . . Foldi Tamas - We Are The Hashmark In The Rootshell - Security Consultant [EMAIL PROTECTED] - PGP: finger:[EMAIL PROTECTED] - (+3630) 221-7477
- Re: SuSe / Debian man package format string vulnerab... StyX
- Re: SuSe / Debian man package format string vul... Martin Schulze
- Re: SuSe / Debian man package format string... Jose Nazario
- Re: SuSe / Debian man package format st... Nate Eldredge
- Re: SuSe / Debian man package format string... Robert Bihlmeyer
- Re: SuSe / Debian man package format string vul... Robert van der Meulen
- Re: SuSe / Debian man package format string... Valdis Kletnieks
- Re: SuSe / Debian man package format string... Ethan Benson
- Re: SuSe / Debian man package format string... John
- Re: SuSe / Debian man package format st... Megyer Ur
- Re: SuSe / Debian man package forma... Foldi Tamas
- Re: SuSe / Debian man package format st... Andreas Ferber
- Re: SuSe / Debian man package format st... Graham Hughes
- Re: SuSe / Debian man package format st... Matt Zimmerman
- Re: SuSe / Debian man package format string... Mate Wierdl
- Re: SuSe / Debian man package format string... Roman Drahtmueller
- Re: SuSe / Debian man package format st... Kris Kennaway
- Re: SuSe / Debian man package format string vulnerab... Darren Moffat
- Re: SuSe / Debian man package format string vul... Seth Arnold
- Re: SuSe / Debian man package format string vul... Dan Harkless
- Re: SuSe / Debian man package format string vul... David Luyer