Date: Fri, 25 May 2001 13:53:17 -0400 (EDT) From: Rob Simmons <rsimmons@wlcg.com> To: alexus <ml@db.nexgen.com> Cc: Nick Cleaton <nick@cleaton.net>, security@FreeBSD.ORG Subject: Re: 4.3 Security: local DoS via clean-tmps Message-ID: <Pine.BSF.4.21.0105251351250.62149-100000@mail.wlcg.com> In-Reply-To: <001301c0e542$474fd3b0$01000001@book>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 That is off by default in FreeBSD. You would have had to add a line like this to /etc/periodic.conf daily_clean_tmps_enable="YES" The line in /etc/defaults/periodic.conf is: daily_clean_tmps_enable="NO" Robert Simmons Systems Administrator http://www.wlcg.com/ On Fri, 25 May 2001, alexus wrote: > how can i make sure that i dont have this enabled? and if there a fix for > that? > > ----- Original Message ----- > From: "Nick Cleaton" <nick@cleaton.net> > To: <security@freebsd.org> > Sent: Friday, May 25, 2001 1:03 PM > Subject: 4.3 Security: local DoS via clean-tmps > > > > > > Tested in 4.3-RELEASE only: > > > > If /etc/periodic/daily/clean-tmps is enabled, then it's possible > > for any local user to trick it into calling unlink() or rmdir() > > on anything in the root directory. > > > > The problem is that "find -delete" can be made to do chdir("..") > > multiple times followed by unlink() and/or rmdir(). > > > > 588 find CALL chdir(0x280e227d) > > 588 find NAMI ".." > > 588 find RET chdir 0 > > 588 find CALL chdir(0x280e227d) > > 588 find NAMI ".." > > 588 find RET chdir 0 > > 588 find CALL chdir(0x280e227d) > > 588 find NAMI ".." > > 588 find RET chdir 0 > > 588 find CALL chdir(0x280e227d) > > 588 find NAMI ".." > > 588 find RET chdir 0 > > 588 find CALL unlink(0x8051440) > > 588 find NAMI "sys" > > > > This means it can be tricked into going up too high by moving > > its current directory higher up the hierarchy, by for example > > doing "mv /tmp/1/2/3 /tmp/4" while find's working directory is > > somewhere under "/tmp/1/2/3". > > > > The attached exploit will cause it to delete the /home -> /usr/home > > symlink. I think this would render it impossible to log into a > > system configured for non-root ssh access via DSA key only. > > > > This could also be used to unlink other users' files in /tmp > > without regard to their age. > > > > -- > > Nick Cleaton > > nick@cleaton.net > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.5 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7DpwSv8Bofna59hYRA3aIAJ40bgRrqBeUU/KwCEWoyECin3rNIQCfeWig 3NZrJFVotoNfWFaMlUdTckA= =+kjL -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0105251351250.62149-100000>