Bugtraq mailing list archives

Re: aterm 0.4.2 tty permission weakness


From: Sebastian Hans <hanss () in tum de>
Date: Wed, 14 Jul 2004 11:59:19 +0200

Maarten Tielemans wrote:


Aterm has an issue with creating a terminal.

A quick ?ls ?al? on a aterm with ?mesg y? shows:
crw--w--w-  1 alsdk  users    5,   3 Jul 13 17:27 /dev/ttyp3
with ?mesg n?:
crw-----w-  1 alsdk  users    5,   3 Jul 13 17:28 /dev/ttyp3

1) World (nobody) is able to ?echo? or ?cat? towards the terminal
echo ?hello? >> /dev/ttyp3
cat mkdir >> /dev/ttyp3 
2) The group seems to be incorrect, a normal terminal has default group tty

When using devpts, it looks good:

$ mesg
is y
$ ls -Al /dev/pts/0
crw--w----  1 phi xxx 136, 0 Jul 14 11:25 /dev/pts/0
$ mesg n
$ ls -Al /dev/pts/0
crw-------  1 phi xxx 136, 0 Jul 14 11:26 /dev/pts/0

Cheers

Seb
-- 
/~\ The ASCII                                             Sebastian Hans
\ / Ribbon Campaign                                      hanss () in tum de
 X  Against HTML                                              0x5AED1E6D
/ \ Email!            014C 4A54 FED4 C0B5 3E87  427B 6910 AB0A 5AED 1E6D

Attachment: _bin
Description:


Current thread: