On Wed, 18 Apr 2001, Bill Sommerfeld wrote:
> For the record, I blocked this way of breaking out of chroot in NetBSD
> in 1999; the fix is present in NetBSD 1.4 and later releases. I'm
> surprised that this hasn't been picked up by more distributions.
That would not decrease possible damage caused by this kind of remote root
vulnerability in typical system, where it is possible to attach to
processes running outside chroot via ptrace and execute mailicious code in
non-chrooted environment, as well as do other tricks - module loading,
creating / acessing special devices, etc. Security improvement would be
visible only on systems where all other possibly dangerous operations are
not available to superuser (rare configuration). But, in genral, this is a
tricky business, and having chrooted attacker with superuser privledges on
your system should make you feel safe, anyway.
--
_______________________________________________________
Michal Zalewski [[EMAIL PROTECTED]] | [security]
[http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :|:&};:
=--=> Did you know that clones never use mirrors? <=--=
