Re: Publically writable directories

[wfp5p () tigger itc virginia edu (Bill Pemberton)]

Thomas Koenig writes:
> When an attacker does
>
> $ ln -s /tmp/some.file /etc/nologin
>
> and has root create /tmp/some.file, the problems are obvious.  Question:
> Can this also create security problems for a 'normal' user?

Quite easily.  What about:

ln -s /tmp/some.file /home/blah/.rhosts

If you can get user blah to open /tmp/some.file and put something like + +
in the file (this was the hole with elm).

Or, a simple screw-up-the-user:

ln -s /tmp/some.file /home/blah/.profile



--
Bill Pemberton                           wfp5p () virginia edu
ITC/Unix Systems                         flash () virginia edu
University of Virginia                   uunet!virginia!wfp5p