Bugtraq mailing list archives
Re: ufsrestore suid root not a security hole
From: mulligan () future incog com (mulligan () future incog com)
Date: Fri, 15 Dec 1995 23:55:50 -0700
Ed wrote:
BUT, it will let you read ANY file from the tape. Including root owned files such as /etc/shadow. * Know when UNIX admins runs backups. * Extract files with ufsrestore (/etc/shadow) * Run Crack. * Or you could be reading root's mail, CEO email ...etc,etc
[ script of reading tape deleted ] Come on Ed. This isn't a ufsrestore problem! If folks can get access to your backup tapes you are hosed. They don't need to use ufsrestore (setuid or not) to read them. They can just read the raw tape if they want to and what ever is there. This isn't any agument against ufsrestore -- it's an argument to physically protect your backup tapes. geoff
Current thread:
- Re: ufsrestore suid root not a security hole Eduardo E. Silva (Dec 12)
- Re: ufsrestore suid root not a security hole mulligan () future incog com (Dec 15)
- Solaris 2.4 panic on tip Doug Hughes (Dec 17)