1 files changed, 54 insertions, 0 deletions

diff --git a/informationals/teso-i0026.txt b/informationals/teso-i0026.txt
new file mode 100644
index 0000000..f2178ac
--- /dev/null
+++ b/informationals/teso-i0026.txt
@@ -0,0 +1,54 @@
+0026 2000/05/30  file existance check through suid binaries
+
+==== TESO Informational =======================================================
+This piece of information is to be kept confidential.
+===============================================================================
+
+Description ..........: file existance check through suid binaries
+Date .................: 2000/05/30 22:00
+Author ...............: scut
+Publicity level ......: most likely known
+Affected .............: some suid binaries
+Type of entity .......: program behaviour
+Type of discovery ....: useful information
+Severity/Importance ..: low
+Found by .............: scut
+
+===============================================================================
+
+Some suid binaries take filenames as arguments. Some of them even do something
+with the files they take as arguments. And some will even tell you somehow what
+happened when they do something.
+
+This natural behaviour may manifast itself in a small error which could be
+security relevant glitch which allows to check for file existance, although
+normally your permission would forbid that.
+
+As an example, here is the behaviour of the latest IRIX 6.5 netstat binary,
+which happens to have setgid sys permissions. The directory "/tmp/rootonly"
+is only accessible to the root user and users in the sys group, so normal
+users don't have permission to access it, but netstat has.
+Netstat uses the stat() function to check for file existance.
+
+hyperion 24% ls -lsa /tmp/rootonly/
+Cannot access directory /tmp/rootonly/: Permission denied
+total 0
+hyperion 25% ls -lsa /tmp/rootonly/foobar
+Cannot access /tmp/rootonly/foobar: Permission denied
+hyperion 26% /usr/etc/netstat 1 /tmp/rootonly/foo
+netstat: cannot open /tmp/rootonly/foo: No such file or directory
+hyperion 27% /usr/etc/netstat 1 /tmp/rootonly/foobar
+    input   (ec0)     output            input  (Total)    output
+ packets  errs  packets  errs colls  packets  errs  packets  errs colls 
+   14980     0    10661     0    45    15353     0    11034     0    45 
+hyperion 28%
+
+The same can be applied to directories, which can be stat'ed too. There
+is a trick to decide whether a found name is a directory or not.
+Let's say you discovered that there is something stat'able called "foo".
+Just append a "/." to it and check for "foo/.". If it is a file this
+won't work, if it is a directory, stat() will happen as if you didn't
+appended the string.
+
+===============================================================================
+