lkml.org 
[lkml]   [2004]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: kernel stack challenge
    From
    Date
    On Wed, 07 Apr 2004 21:07:56 PDT, Sergiy Lozovsky said:

    > Actually one 'dynamic' feature is implemented in VXE.
    > In ordinary system resource has permissions which
    > allows access or not. For higher security VXE can
    > count number of allowed accesses. For example, we are
    > securing POP server. We allow it to open /etc/passwd,
    > /etc/shadow for reading only once (counter is 1). So,
    > if hacker breaks to POP server after it opened
    > /etc/passwd - there is no way hacker can open this
    > file.

    Unless he finds an already open file descriptor for it and uses
    read()/write()/mmap()/etc - did you audit your POP server
    to make *really* sure that endpwent() is called at all the right
    times, and that said function actually is guaranteed to close()
    the file descriptor, and can't be forced into failing? (Note that
    this can be caused by either close() syscall failing, or the attacker
    managing to hijack the function entry point for either endpwent()
    or close()....)

    Unless he finds a copy of the file on the process heap (more than
    one information leakage issue has come from THAT sort of problem)

    Unless he opens a new file on the system, and writes a binary into
    it, chmod's it to executable, and does a pipe/fork/exec and use
    that program's quota of opens to read it...

    And that's just the *obvious* end runs. As somebody else noted,
    writing the code is the easy part....
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2005-03-22 14:02    [W:0.031 / U:33.260 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site