Full Disclosure mailing list archives
Re: Security hole in Confixx backup script
From: Dirk Pirschel <dirk () pirschel de>
Date: Wed, 11 Aug 2004 01:39:04 +0200
Hi, * Dirk Pirschel wrote on Tue, 10 Aug 2004 at 12:42 +0200:
The race condition between "tar xzf" and "chmod -R" can be won, if there are many files or simply one big file in the archives. A quick "mv" should prevent the suid programm from beeing chown()ed.
There is no race condition at all. We can simply use a symlink, which is only followed by "cd; tar". (Remember that tar gets executed with a relative path to ../restore/<tarfile>, but this is no problem ;-). chown is called with an absolute path and changes the UID of the link. -Dirk -- Close the windows - the penguin is freezing
Attachment:
_bin
Description:
Current thread:
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 02)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 09)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 09)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 10)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 10)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 10)
- Re: Security hole in Confixx backup script Valdis . Kletnieks (Aug 10)
- Re: Security hole in Confixx backup script Thomas Loch (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 10)
- RE: Security hole in Confixx backup script Aditya, ALD [Aditya Lalit Deshmukh] (Aug 10)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 09)
- Re: Security hole in Confixx backup script Dirk Pirschel (Aug 13)