Full Disclosure mailing list archives
Re: Back To The Future: Unix Wildcards Gone Wild
From: Nick Lindridge <nick () ioncube com>
Date: Fri, 27 Jun 2014 11:39:22 +0100
This is an interesting old trick but not any fault with the wildcard mechanism (though a bit array indicating whether an argv item is the result of an expansion would be nice). Taking the rm program as an example, the vulnerability report should really be citing rm as vulnerable for failing to factor knowledge of this behaviour into some sanity checking. As a start, rm could test to see whether any of the command line options match files to be removed, knowing that the option could then have come from an unintended wildcard expansion. The program could then require an option to force the operation.
If we accept therefore that the deficiency is with the utilities themselves, perhaps you could research and contribute a vulnerability report that lists all of the commonly used programs that could be affected by this behaviour. Such a report could set the basis for a road map of improvement in the listed utilities.
Nick On 26/06/2014 09:40, defensecode wrote:
Hi, We wanted to inform all major *nix distributions via our responsible disclosure policy about this problem before posting it, because it is highly likely that this problem could lead to local root access on many distributions. But, since part of this research contained in the document was mentioned on some blog entries, we are forced to release it in a full version. Download URL: http://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt Regards, Leon Juranic _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
-- Best regards Nick -- ionCube Software LLP @ioncube / uk.linkedin.com/in/nicklindridge +44-208-099-3608 _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Back To The Future: Unix Wildcards Gone Wild defensecode (Jun 26)
- Re: Back To The Future: Unix Wildcards Gone Wild Michal Zalewski (Jun 26)
- Re: Back To The Future: Unix Wildcards Gone Wild Julius Kivimäki (Jun 27)
- Re: Back To The Future: Unix Wildcards Gone Wild fulldisclosure (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild Daniel Miller (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild Nico Le Moin (Jun 29)
- Re: Back To The Future: Unix Wildcards Gone Wild fulldisclosure (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild gremlin (Jun 27)
- Re: Back To The Future: Unix Wildcards Gone Wild Nick Lindridge (Jun 27)
- Re: Back To The Future: Unix Wildcards Gone Wild steel-wing (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild Cley Faye (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild * (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild steel-wing (Jun 28)
- Re: Back To The Future: Unix Wildcards Gone Wild Ivan Delalande (Jun 27)
- Re: Back To The Future: Unix Wildcards Gone Wild Michal Zalewski (Jun 27)
- Re: Back To The Future: Unix Wildcards Gone Wild Peter Stamfest (Jun 29)