From owner-freebsd-security Wed May 30 12:31:54 2001 Delivered-To: freebsd-security@freebsd.org Received: from db.nexgen.com (db.nexgen.com [64.81.208.78]) by hub.freebsd.org (Postfix) with SMTP id 889D837B424 for ; Wed, 30 May 2001 12:31:47 -0700 (PDT) (envelope-from ml@db.nexgen.com) Received: (qmail 15554 invoked from network); 30 May 2001 19:35:13 -0000 Received: from unknown (HELO book) (root@127.0.0.1) by 127.0.0.1 with SMTP; 30 May 2001 19:35:13 -0000 Message-ID: <005801c0e93f$2af71060$01000001@book> From: "alexus" To: "Rob Simmons" Cc: "Nick Cleaton" , References: Subject: Re: 4.3 Security: local DoS via clean-tmps Date: Wed, 30 May 2001 15:31:47 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org ok then i'm calm:) ----- Original Message ----- From: "Rob Simmons" To: "alexus" Cc: "Nick Cleaton" ; Sent: Friday, May 25, 2001 1:53 PM Subject: Re: 4.3 Security: local DoS via clean-tmps > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > That is off by default in FreeBSD. You would have had to add a line like > this to /etc/periodic.conf > > daily_clean_tmps_enable="YES" > > The line in /etc/defaults/periodic.conf is: > > daily_clean_tmps_enable="NO" > > Robert Simmons > Systems Administrator > http://www.wlcg.com/ > > On Fri, 25 May 2001, alexus wrote: > > > how can i make sure that i dont have this enabled? and if there a fix for > > that? > > > > ----- Original Message ----- > > From: "Nick Cleaton" > > To: > > Sent: Friday, May 25, 2001 1:03 PM > > Subject: 4.3 Security: local DoS via clean-tmps > > > > > > > > > > Tested in 4.3-RELEASE only: > > > > > > If /etc/periodic/daily/clean-tmps is enabled, then it's possible > > > for any local user to trick it into calling unlink() or rmdir() > > > on anything in the root directory. > > > > > > The problem is that "find -delete" can be made to do chdir("..") > > > multiple times followed by unlink() and/or rmdir(). > > > > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL chdir(0x280e227d) > > > 588 find NAMI ".." > > > 588 find RET chdir 0 > > > 588 find CALL unlink(0x8051440) > > > 588 find NAMI "sys" > > > > > > This means it can be tricked into going up too high by moving > > > its current directory higher up the hierarchy, by for example > > > doing "mv /tmp/1/2/3 /tmp/4" while find's working directory is > > > somewhere under "/tmp/1/2/3". > > > > > > The attached exploit will cause it to delete the /home -> /usr/home > > > symlink. I think this would render it impossible to log into a > > > system configured for non-root ssh access via DSA key only. > > > > > > This could also be used to unlink other users' files in /tmp > > > without regard to their age. > > > > > > -- > > > Nick Cleaton > > > nick@cleaton.net > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.5 (FreeBSD) > Comment: For info see http://www.gnupg.org > > iD8DBQE7DpwSv8Bofna59hYRA3aIAJ40bgRrqBeUU/KwCEWoyECin3rNIQCfeWig > 3NZrJFVotoNfWFaMlUdTckA= > =+kjL > -----END PGP SIGNATURE----- > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message