Full Disclosure mailing list archives
Re: Security hole in Confixx backup script
From: Dirk Pirschel <dirk () pirschel de>
Date: Tue, 10 Aug 2004 12:42:35 +0200
Hi, * Valdis.Kletnieks () vt edu wrote on Mon, 09 Aug 2004 at 21:26 -0400:
On Tue, 10 Aug 2004 02:16:24 +0200, Thomas Loch said:
What if someone creates a shell script [...] and sets the SetUID flag. Then he makes a backup of that file and restores the backup while he prevents the chown-command anyhow. All files will remain "root".
The race condition between "tar xzf" and "chmod -R" can be won, if there are many files or simply one big file in the archives. A quick "mv" should prevent the suid programm from beeing chown()ed.
You'd probably have to work a *little* harder than a shell script - most Unixoid systems don't allow the execution of a setUID shell script due to various and sundry race conditions involved (which is why 'suidperl' exists). Other than that, you're on the right track.. ;)
What about a suid bash? ;-) -Dirk -- Linux: Who needs Windows and Gates in a world without walls and fences?
Attachment:
_bin
Description:
Current thread:
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 02)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 09)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 09)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 10)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 10)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 10)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 10)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 10)
- RE: Security hole in Confixx backup script Aditya, ALD [Aditya Lalit Deshmukh] (Aug 10)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 13)