blob: f2178acf9763461bf9658a4ad4153a2b02a928d6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
0026 2000/05/30 file existance check through suid binaries
==== TESO Informational =======================================================
This piece of information is to be kept confidential.
===============================================================================
Description ..........: file existance check through suid binaries
Date .................: 2000/05/30 22:00
Author ...............: scut
Publicity level ......: most likely known
Affected .............: some suid binaries
Type of entity .......: program behaviour
Type of discovery ....: useful information
Severity/Importance ..: low
Found by .............: scut
===============================================================================
Some suid binaries take filenames as arguments. Some of them even do something
with the files they take as arguments. And some will even tell you somehow what
happened when they do something.
This natural behaviour may manifast itself in a small error which could be
security relevant glitch which allows to check for file existance, although
normally your permission would forbid that.
As an example, here is the behaviour of the latest IRIX 6.5 netstat binary,
which happens to have setgid sys permissions. The directory "/tmp/rootonly"
is only accessible to the root user and users in the sys group, so normal
users don't have permission to access it, but netstat has.
Netstat uses the stat() function to check for file existance.
hyperion 24% ls -lsa /tmp/rootonly/
Cannot access directory /tmp/rootonly/: Permission denied
total 0
hyperion 25% ls -lsa /tmp/rootonly/foobar
Cannot access /tmp/rootonly/foobar: Permission denied
hyperion 26% /usr/etc/netstat 1 /tmp/rootonly/foo
netstat: cannot open /tmp/rootonly/foo: No such file or directory
hyperion 27% /usr/etc/netstat 1 /tmp/rootonly/foobar
input (ec0) output input (Total) output
packets errs packets errs colls packets errs packets errs colls
14980 0 10661 0 45 15353 0 11034 0 45
hyperion 28%
The same can be applied to directories, which can be stat'ed too. There
is a trick to decide whether a found name is a directory or not.
Let's say you discovered that there is something stat'able called "foo".
Just append a "/." to it and check for "foo/.". If it is a file this
won't work, if it is a directory, stat() will happen as if you didn't
appended the string.
===============================================================================
|
