Security Incidents mailing list archives
Re: Suspicious files in /tmp
From: Cy Schubert <Cy.Schubert () komquats com>
Date: Thu, 21 Jun 2007 13:05:44 -0700
In message <46277.194.74.82.3.1182425927.squirrel () galain elvandar org>, "Remko Lodder" writes:
Hello Matt, Indeed FreeBSD doesn't respect the cases where a shell script is on a noexec mounted device; but where /bin/sh is still executable (/bin/sh /tmp/script for example). From the Manual page this should be clear that it is not designed as a security measure but to aid other activities; it is unlikely that we (see the archives for more information, this had been discussed a couple of times) will change this behaviour (since the design isn't for security): mount(8): noexec Do not allow execution of any binaries on the mounted file system. This option is useful for a server that has file systems containing binaries for architectures other than its own. Note: This option was not designed as a security feature and no guarantee is made that it will prevent malicious code execution; for example, it is still possible to execute scripts which reside on a noexec mounted partition. Hope this helps aiding you a bit with the information we can deliver.
All that is needed to execute a shell script is read access. -- Cheers, Cy Schubert <Cy.Schubert () komquats com> FreeBSD UNIX: <cy () FreeBSD org> Web: http://www.FreeBSD.org e**(i*pi)+1=0 ------------------------------------------------------------------------- This list sponsored by: SPI Dynamics ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper It's as simple as placing additional SQL commands into a Web Form input box giving hackers complete access to all your backend systems! Firewalls and IDS will not stop such attacks because SQL Injections are NOT seen as intruders. Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E --------------------------------------------------------------------------
Current thread:
- Re: Suspicious files in /tmp, (continued)
- Re: Suspicious files in /tmp Michal Zalewski (Jun 19)
- Message not available
- Re: Suspicious files in /tmp Michal Zalewski (Jun 20)
- Re: Suspicious files in /tmp Rainer Duffner (Jun 19)
- Re: Suspicious files in /tmp Rainer Duffner (Jun 19)
- Re: Suspicious files in /tmp Robin Sheat (Jun 19)
- Re: Suspicious files in /tmp Valdis . Kletnieks (Jun 20)
- RE: Suspicious files in /tmp Thyago Braga da Silva (Jun 21)
- RE: Suspicious files in /tmp kaneda (Jun 21)
- Re: Suspicious files in /tmp Eduardo Tongson (Jun 22)
- Re: Suspicious files in /tmp Cy Schubert (Jun 21)