R: Linux kernel source archive vulnerable

["Perego Paolo Franco" <p.perego () reply it>]

Hi Hadmut, by the way cross post is bad so I'll reply only in bugtraq. The ones you 
report are not, IMHO, vulnerability in Linux Kernel source code archive.
May be you want to administer your severs ina secure fashoned way involving a 
proper ownership access to /user/src and /lib/modules path ensuring that regular 
user belonging to special group can write into it.
If "compile it's usually done as root" is not a kernel vulnerability but a non secure 
aware sysadmin behaviour. 
Consider "--no-same-owner" or "--owner" tar flags in order to customize extracted
file ownership.
 
Anyway just few considerations:
1) a server exposed to Interne, is NOT supposed to have compiler installed in it. 
You may use a compile machine to build custom kernel and installing to your production 
environment or you may want to use your ditribution kernel package.
So you don't need to have /usr/src/linux at all.
2) a good sysadmin is aware that /usr/src is NOT supposed to be world writable
 
Anyway... I don't think this is a "severe vulnerability in the Linux kernel source code
archives". IMHO, of course
 
My 0,02EUR
 
sp0nge


________________________________

Da: Hadmut Danisch [mailto:hadmut () danisch de]
Inviato: gio 07/09/2006 20.23
A: full-disclosure () lists grok org uk; bugtraq () securityfocus com
Oggetto: Linux kernel source archive vulnerable



Hi,

there's a severe vulnerability in the Linux kernel source code archives:


The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:


1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
   world writable directories at a well defined place, perfect to hide
   any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
   the kernel to be compiled.

3. any user or intruder could modify the build or installation
   system/Makefiles in order to have any kind of malware executed by
   root the next time a kernel is built or installed, or any other
   kernel module making use of the kernel tree.


Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

--
The information transmitted is intended for the person or entity to which it is addressed and may contain confidential 
and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in 
reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received 
this in error, please contact the sender and delete the material from any computer.