Bugtraq mailing list archives
Re: snap utility for AIX.
From: hauber () AUSTIN IBM COM (Brian Hauber)
Date: Thu, 18 Feb 1999 14:25:57 -0600
On Wed, Feb 17, 1999 at 10:17:08AM -0500, Larry W. Cashdollar wrote:
My friend actually brought this to my attention, the snap command is a diagnostic utlitiy for gathering system information on AIX platforms. It can only be executed by root, but it copies various system files into /tmp/ibmsupt/ under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext. The danger here is if a system administrator executes snap -a as sometimes requested by IBM support while diagnosing a problem it defeats password shadowing. I would think that snap would create the directory 700 root:root.
Yes, /tmp/ibmsupt is created with 755 permissions however what you neglected to check was the permissions on /tmp/ibmsupt/general/passwd I took the liberty of running 'snap -a' on our systems here at varying levels and here are the results: ------------------------------------------------------------------------------- 3.2.5.1 with 3.2.5.1-02 Maintenance Level # ls -ld /tmp/ibmsupt drwxr-xr-x 17 root system 512 Feb 18 02:08 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root security 1585 Feb 9 05:45 /tmp/ibmsupt/general/passwd ------------------------------------------------------------------------------- 4.1.5 BASE # ls -ld /tmp/ibmsupt drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd ------------------------------------------------------------------------------- 4.1.5 with 4.1.5-01 Maintenance Level # ls -ld /tmp/ibmsupt drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root system 2183 Feb 18 10:09 /tmp/ibmsupt/general/passwd -------------------------------------------------------------------------------- 4.2.1 BASE # ls -ld /tmp/ibmsupt drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd -------------------------------------------------------------------------------- 4.2.1 with 4.2.1-03 Maintenance Level # ls -ld /tmp/ibmsupt drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd -------------------------------------------------------------------------------- 4.3.1 BASE # ls -ld /tmp/ibmsupt drwxr-xr-x 18 root system 512 Feb 18 12:03 /tmp/ibmsupt/ HOWEVER # ls -ld /tmp/ibmsupt/general/passwd -rw------- 1 root security 1210 Feb 18 10:55 /tmp/ibmsupt/general/passwd -------------------------------------------------------------------------------- 4.3.2 BASE # ls -ld /tmp/ibmsupt drwx------ 18 root system 512 Feb 18 14:02 /tmp/ibmsupt/ -------------------------------------------------------------------------------- This "problem" seems to have been fixed at 4.3.2. -- Brian Hauber | AIX Support Line | E-mail: hauber () austin ibm com
Current thread:
- Re: [proftpd-l] root compromise ? (fwd) Rodrigo Campos (Feb 09)
- Re: [proftpd-l] root compromise ? (fwd) Joe Schmo (Feb 12)
- Re: [proftpd-l] root compromise ? (fwd) monk (Feb 13)
- Re: [proftpd-l] root compromise ? (fwd) Dirk Moerenhout (Feb 13)
- Possible Netscape Crypto Security Flaw Haze (Feb 14)
- Re: Possible Netscape Crypto Security Flaw Pete Krawczyk (Feb 16)
- snap utility for AIX. Larry W. Cashdollar (Feb 17)
- Re: snap utility for AIX. Brian Hauber (Feb 18)
- mSQL vulnerability. Christofer C. Bell (Feb 17)
- OT: Copyright on Security advisories Aviram Jenik (Feb 18)
- Re: OT: Copyright on Security advisories Doug Granzow (Feb 19)
- Re: mSQL vulnerability. John W. Temples (Feb 18)
- Re: [proftpd-l] root compromise ? (fwd) Joe Schmo (Feb 12)
- Debian GNU/Linux 2.0r5 released (fwd) Jamie Fifield (Feb 17)
- Regarding passwords in registry keys. Ash (Feb 19)
- Re: [proftpd-l] root compromise ? (fwd) Nic Bellamy (Feb 14)
- Re: ICQ99 crash Eric J. Stevens (Feb 15)
- Re: ICQ99 crash Joe Stewart (Feb 16)