From owner-freebsd-security  Fri May 25 10:53:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.wlcg.com (mail.wlcg.com [207.226.17.4])
	by hub.freebsd.org (Postfix) with ESMTP id 5DE1E37B423
	for <security@FreeBSD.ORG>; Fri, 25 May 2001 10:53:41 -0700 (PDT)
	(envelope-from rsimmons@wlcg.com)
Received: from localhost (rsimmons@localhost)
	by mail.wlcg.com (8.11.3/8.11.3) with ESMTP id f4PHrMG62258;
	Fri, 25 May 2001 13:53:22 -0400 (EDT)
	(envelope-from rsimmons@wlcg.com)
Date: Fri, 25 May 2001 13:53:17 -0400 (EDT)
From: Rob Simmons <rsimmons@wlcg.com>
To: alexus <ml@db.nexgen.com>
Cc: Nick Cleaton <nick@cleaton.net>, security@FreeBSD.ORG
Subject: Re: 4.3 Security: local DoS via clean-tmps
In-Reply-To: <001301c0e542$474fd3b0$01000001@book>
Message-ID: <Pine.BSF.4.21.0105251351250.62149-100000@mail.wlcg.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

That is off by default in FreeBSD.  You would have had to add a line like
this to /etc/periodic.conf

daily_clean_tmps_enable="YES"

The line in /etc/defaults/periodic.conf is:

daily_clean_tmps_enable="NO"

Robert Simmons
Systems Administrator
http://www.wlcg.com/

On Fri, 25 May 2001, alexus wrote:

> how can i make sure that i dont have this enabled? and if there a fix for
> that?
> 
> ----- Original Message -----
> From: "Nick Cleaton" <nick@cleaton.net>
> To: <security@freebsd.org>
> Sent: Friday, May 25, 2001 1:03 PM
> Subject: 4.3 Security: local DoS via clean-tmps
> 
> 
> >
> > Tested in 4.3-RELEASE only:
> >
> > If /etc/periodic/daily/clean-tmps is enabled, then it's possible
> > for any local user to trick it into calling unlink() or rmdir()
> > on anything in the root directory.
> >
> > The problem is that "find -delete" can be made to do chdir("..")
> > multiple times followed by unlink() and/or rmdir().
> >
> >    588 find     CALL  chdir(0x280e227d)
> >    588 find     NAMI  ".."
> >    588 find     RET   chdir 0
> >    588 find     CALL  chdir(0x280e227d)
> >    588 find     NAMI  ".."
> >    588 find     RET   chdir 0
> >    588 find     CALL  chdir(0x280e227d)
> >    588 find     NAMI  ".."
> >    588 find     RET   chdir 0
> >    588 find     CALL  chdir(0x280e227d)
> >    588 find     NAMI  ".."
> >    588 find     RET   chdir 0
> >    588 find     CALL  unlink(0x8051440)
> >    588 find     NAMI  "sys"
> >
> > This means it can be tricked into going up too high by moving
> > its current directory higher up the hierarchy, by for example
> > doing "mv /tmp/1/2/3 /tmp/4" while find's working directory is
> > somewhere under "/tmp/1/2/3".
> >
> > The attached exploit will cause it to delete the /home -> /usr/home
> > symlink.  I think this would render it impossible to log into a
> > system configured for non-root ssh access via DSA key only.
> >
> > This could also be used to unlink other users' files in /tmp
> > without regard to their age.
> >
> > --
> > Nick Cleaton
> > nick@cleaton.net
> >
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.5 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7DpwSv8Bofna59hYRA3aIAJ40bgRrqBeUU/KwCEWoyECin3rNIQCfeWig
3NZrJFVotoNfWFaMlUdTckA=
=+kjL
-----END PGP SIGNATURE-----



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message