From owner-freebsd-questions Tue Jan 7 10:41:11 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 58D4C37B401 for ; Tue, 7 Jan 2003 10:41:10 -0800 (PST) Received: from mired.org (ip68-97-54-220.ok.ok.cox.net [68.97.54.220]) by mx1.FreeBSD.org (Postfix) with SMTP id 278DE43E4A for ; Tue, 7 Jan 2003 10:41:09 -0800 (PST) (envelope-from mwm-dated-1042396868.c58ddd@mired.org) Received: (qmail 98094 invoked from network); 7 Jan 2003 18:41:08 -0000 Received: from localhost.mired.org (HELO guru.mired.org) (127.0.0.1) by localhost.mired.org with SMTP; 7 Jan 2003 18:41:08 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <15899.8003.614686.55789@guru.mired.org> Date: Tue, 7 Jan 2003 12:41:07 -0600 To: Mark Cc: questions@freebsd.org Subject: Re: security vulnerability in dump In-Reply-To: <200301071835.H07IZMJ40741@asarian-host.net> References: <200301071548.H07FM0J93369@asarian-host.net> <20030107180013.D14422@slave.east.ath.cx> <200301071835.H07IZMJ40741@asarian-host.net> X-Mailer: VM 7.07 under 21.1 (patch 14) "Cuyahoga Valley" XEmacs Lucid X-face: "5Mnwy%?j>IIV\)A=):rjWL~NB2aH[}Yq8Z=u~vJ`"(,&SiLvbbz2W`; h9L,Yg`+vb1>RG% *h+%X^n0EZd>TM8_IB;a8F?(Fb"lw'IgCoyM.[Lg#r\ From: Mike Meyer X-Delivery-Agent: TMDA/0.67 (Whirlaway) Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi Mark, > When dumping to a file, dump writes this file chmod 644. When the > root-partition is being backed-up, this leaves the dump-file vulnerable > to scanning by unprivileged users for the duration of the dump. This is an important issue you've found in dump. Please submit a PR with the send-pr command so the security people will see it. They may read this list, but they may not. They do read PR's flagged as security issues. http://www.mired.org/consulting.html Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message