Full Disclosure mailing list archives
Re: Symlink vulnerabilities
From: halfdog <me () halfdog net>
Date: Thu, 27 Oct 2011 20:11:55 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Andrew Farmer wrote:
On 2011-10-27, at 07:48, Valdis.Kletnieks () vt edu wrote:The other thing that people need to remember is that there's no race condition that's so small that you can't hit it. If there's a race condition, it *can* be won.And systems like inotify make filesystem races trivial to win. I wouldn't be surprised if you could win this particular race reliably by watching for the files bzexe drops and acting immediately when they show up.
You might want to try out my tool from http://www.halfdog.net/Security/2010/FilesystemRecursionAndSymlinks/ from the references section at end of the page. With appropriate watchcount parameter, it won every race against each backup system tested back then. As to my knowledge, only tar was fixed so far. Running it against cpio even triggers buffer overflow, so direct root escalation might be possible. I haven't done proof for MS-Systems, does someone have interest in a joint venture? hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk6puu4ACgkQxFmThv7tq+71xQCfTyOcgr+LEQtiMEWSjWu5xUBK gsIAoJHIhCSpYgMJXX/0QNV59+aXtTyz =0Dcq -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Symlink vulnerabilities, (continued)
- Re: Symlink vulnerabilities xD 0x41 (Oct 27)
- Re: Symlink vulnerabilities Valdis . Kletnieks (Oct 27)
- Re: Symlink vulnerabilities bugs (Oct 27)
- Re: Symlink vulnerabilities xD 0x41 (Oct 27)
- Message not available
- Re: Symlink vulnerabilities bugs (Oct 27)
- Re: Symlink vulnerabilities Valdis . Kletnieks (Oct 27)
- Re: Symlink vulnerabilities Valdis . Kletnieks (Oct 27)
- Re: Symlink vulnerabilities Andrew Farmer (Oct 27)
- Re: Symlink vulnerabilities Valdis . Kletnieks (Oct 27)
- Re: Symlink vulnerabilities GloW - XD (Oct 27)
- Re: Symlink vulnerabilities halfdog (Oct 27)
- Re: Symlink vulnerabilities xD 0x41 (Oct 27)
- Re: Symlink vulnerabilities Benjamin Renaut (Oct 27)
- Re: Symlink vulnerabilities Benjamin Renaut (Oct 27)
- Re: Symlink vulnerabilities bugs (Oct 27)
- Re: Symlink vulnerabilities Benjamin Renaut (Oct 27)
- Re: Symlink vulnerabilities bugs (Oct 27)
- Re: Symlink vulnerabilities vladz (Oct 27)
- Re: Symlink vulnerabilities Benjamin Renaut (Oct 27)
- Re: Symlink vulnerabilities xD 0x41 (Oct 27)
- Re: Symlink vulnerabilities xD 0x41 (Oct 25)