From owner-freebsd-security Mon Feb 26 13:19:48 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id NAA17305 for security-outgoing; Mon, 26 Feb 1996 13:19:48 -0800 (PST) Received: from kdat.calpoly.edu (kdat.csc.calpoly.edu [129.65.54.101]) by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id NAA17300 for ; Mon, 26 Feb 1996 13:19:46 -0800 (PST) Received: (from nlawson@localhost) by kdat.calpoly.edu (8.6.12/N8) id NAA13075; Mon, 26 Feb 1996 13:19:27 -0800 From: Nathan Lawson Message-Id: <199602262119.NAA13075@kdat.calpoly.edu> Subject: Re: Suspicious symlinks in /tmp To: msmith@comtch.iea.com (Mark Smith) Date: Mon, 26 Feb 1996 13:19:27 -0800 (PST) Cc: security@freebsd.org In-Reply-To: <199602261536.PAA11711@comtch.iea.com> from "Mark Smith" at Feb 26, 96 07:36:50 am X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-security@freebsd.org Precedence: bulk > > > > > On Sun, 25 Feb 1996, Mark Smith wrote: > > > > > Looks like someone is trying to exploit a race condition in order to grab > > > > the password file. > > > > > > Will this attack work under FreeBSD 2.1R ? > > > Mark > > > > A race condition attack will work under any OS when a race condition is > > possible. > > > > Possibly, I didn't make my self clear. Is this race condition possible > under FreeBSD 2.1R ? No. Absolutely not. That was a bug in SunOS's passwd program. Specifying -F allowed the user to specify a passwd file to change. However, the bug that I have seen for quite a while and complained about is that a symlink is owned by the owner of the file it points to, not by the creator of the symlink. That is a bad idea and I really can't see the logic behind doing that. Could someone explain this behavior? -- Nate Lawson \Yeah, I was dreaming through the 'howzlife', yawning, car black, CS-EE double \when she told me 'mad and meaningless as ever...' and a song major, \came on the radio like a cemetery rhyme for a million crying unaccredited \corpses in their tragedy of respectable existence. - BR