lkml.org 
[lkml]   [2004]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Program-invoking Symbolic Links?
    From
    Date
    viro@parcelfarce.linux.theplanet.co.uk writes:

    > On Thu, Aug 05, 2004 at 07:34:42PM +0200, Måns Rullgård wrote:
    >> > ~luser/foo => "cp /bin/sh /tmp/...; chmod 4777 /tmp/...; cat ~luser/foo.real"
    >> >
    >> > Any questions?
    >>
    >> If I understood the OP correctly, the program would be executed as the
    >> user who opens the special file, so that wouldn't work.
    >
    > Yes, it would. Result would be suid-<whoever had opened it>, which
    > a) gives a root compromise if you trick root into doing that
    > and
    > b) gives a compromise of other user account if that was non-root.

    Of course you're right.

    > Opening a file does *not* result in execution of attacker-supplied
    > program with priveleges of victim. Breaking that warranty opens a
    > fsck-knows-how-many holes.

    Just look at msoutlook.

    --
    Måns Rullgård
    mru@kth.se
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:04    [W:0.021 / U:89.868 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site