lkml.org 
[lkml]   [2004]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: kernel stack challenge
From
Date
On Wed, 07 Apr 2004 21:07:56 PDT, Sergiy Lozovsky said:

> Actually one 'dynamic' feature is implemented in VXE.
> In ordinary system resource has permissions which
> allows access or not. For higher security VXE can
> count number of allowed accesses. For example, we are
> securing POP server. We allow it to open /etc/passwd,
> /etc/shadow for reading only once (counter is 1). So,
> if hacker breaks to POP server after it opened
> /etc/passwd - there is no way hacker can open this
> file.

Unless he finds an already open file descriptor for it and uses
read()/write()/mmap()/etc - did you audit your POP server
to make *really* sure that endpwent() is called at all the right
times, and that said function actually is guaranteed to close()
the file descriptor, and can't be forced into failing? (Note that
this can be caused by either close() syscall failing, or the attacker
managing to hijack the function entry point for either endpwent()
or close()....)

Unless he finds a copy of the file on the process heap (more than
one information leakage issue has come from THAT sort of problem)

Unless he opens a new file on the system, and writes a binary into
it, chmod's it to executable, and does a pipe/fork/exec and use
that program's quota of opens to read it...

And that's just the *obvious* end runs. As somebody else noted,
writing the code is the easy part....
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:02    [W:2.486 / U:0.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site