From owner-freebsd-security Wed Nov 21 11:16:44 2001 Delivered-To: freebsd-security@freebsd.org Received: from tomts10-srv.bellnexxia.net (tomts10.bellnexxia.net [209.226.175.54]) by hub.freebsd.org (Postfix) with ESMTP id F17F237B419 for ; Wed, 21 Nov 2001 11:16:36 -0800 (PST) Received: from khan.anarcat.dyndns.org ([65.94.128.110]) by tomts10-srv.bellnexxia.net (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP id <20011121191636.CDOF17034.tomts10-srv.bellnexxia.net@khan.anarcat.dyndns.org> for ; Wed, 21 Nov 2001 14:16:36 -0500 Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1]) by khan.anarcat.dyndns.org (Postfix) with ESMTP id 408501A38 for ; Wed, 21 Nov 2001 14:17:46 -0500 (EST) Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000) id 6162420ADB; Wed, 21 Nov 2001 14:18:08 -0500 (EST) Date: Wed, 21 Nov 2001 14:18:08 -0500 From: The Anarcat To: FreeBSD Security Issues Subject: fun with pkg_add Message-ID: <20011121191808.GD44370@shall.anarcat.dyndns.org> Mail-Followup-To: FreeBSD Security Issues Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="76DTJ5CE0DCVQemd" Content-Disposition: inline User-Agent: Mutt/1.3.23.2i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --76DTJ5CE0DCVQemd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! I just noticed something that could be a problem with pkg_add algorithms. When it installs a package, it first untars it in a temporary directory. The problem is that the subdirectories of the package created this way are world-writable: $ ftp -a ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/All/auctex-10.0g.= tgz $ pkg_add auctex-10.0g.tgz ^Z $ ls -l /var/tmp/inst* total 23 -rw-r--r-- 1 root wheel 57 12 nov 02:07 +COMMENT -rw-r--r-- 1 root wheel 11223 12 nov 02:07 +CONTENTS -rw-r--r-- 1 root wheel 1224 12 nov 02:07 +DESC -rw-r--r-- 1 root wheel 815 12 nov 02:07 +DISPLAY -r--r--r-- 1 root wheel 5181 12 nov 02:07 +MTREE_DIRS drwxrwxrwx 2 root wheel 512 21 nov 14:15 info/ drwxrwxrwx 4 root wheel 512 21 nov 14:15 share/ Lovely. I don't exactly know why it happens this way.=20 I think this could be a security problem if a random user happens to run around /var/tmp while the admin is adding a package.=20 Am I wrong? A. --76DTJ5CE0DCVQemd Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjv7/e8ACgkQttcWHAnWiGc75wCggihc+/vdzYFd+8FHRPlQEkQm xUwAniELnlhqkKt0cv1dPpAR/nIM+Y1p =cPkK -----END PGP SIGNATURE----- --76DTJ5CE0DCVQemd-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message