Date: Tue, 18 May 2010 21:11:26 GMT From: Paul Rascagneres <rootbsd@r00ted.com> To: freebsd-gnats-submit@FreeBSD.org Subject: i386/146718: We can create a file in /etc with simple user using chpass Message-ID: <201005182111.o4ILBQIM025066@www.freebsd.org> Resent-Message-ID: <201005182120.o4ILK1Eq006241@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 146718 >Category: i386 >Synopsis: We can create a file in /etc with simple user using chpass >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-i386 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue May 18 21:20:01 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Paul Rascagneres >Release: FreeBSD 8.0 >Organization: - >Environment: FreeBSD freebsd-laptop 8.0-STABLE FreeBSD 8.0-STABLE #1: Thu May 13 18:40:45 UTC 2010 root@freebsd-laptop:/usr/obj/usr/src/sys/POL_DTRACE i386 >Description: We can create a file in /etc by killing chpass. Example on my website : http://www.r00ted.com/doku.php?id=0day_freebsd_chpass Example : On xterm 1 : [pol@freebsd-laptop]$ export EDITOR=vi [pol@freebsd-laptop]$ chpass #Changing user information for pol. Shell: /usr/local/bin/bash Full Name: User & Office Location: Office Phone: Home Phone: Other information: On xterm 2 : [pol@freebsd-laptop ~]$ ps aux | grep chpass root 1736 0.0 0.1 3504 1276 2 SN+ 11:56PM 0:00.00 chpass pol 1739 0.0 0.1 3496 1260 4 SN+ 11:56PM 0:00.00 grep chpass [pol@freebsd-laptop ~]$ pstree 1736 -+= 01736 root chpass \--- 01737 pol vi /etc/pw.Iu09aU [pol@freebsd-laptop ~]$ kill -9 01736 After kill the file is not remove from /etc : [pol@freebsd-laptop ~]$ ls -l /etc/pw.Iu09aU -rw------- 1 pol pol 147 May 17 23:56 /etc/pw.Iu09aU I think it's strange to create temp file in /etc... Why put it on /tmp? >How-To-Repeat: I mention it on full description. >Fix: I think you need to modify the tempname in the file /usr/src/lib/libutil/pw_util.c to put it on /tmp >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201005182111.o4ILBQIM025066>