Messages in this thread | | | Subject | Re: kernel stack challenge | From | Valdis.Kletnieks@vt ... | Date | Thu, 08 Apr 2004 11:44:23 -0400 |
| |
On Wed, 07 Apr 2004 21:07:56 PDT, Sergiy Lozovsky said:
> Actually one 'dynamic' feature is implemented in VXE. > In ordinary system resource has permissions which > allows access or not. For higher security VXE can > count number of allowed accesses. For example, we are > securing POP server. We allow it to open /etc/passwd, > /etc/shadow for reading only once (counter is 1). So, > if hacker breaks to POP server after it opened > /etc/passwd - there is no way hacker can open this > file.
Unless he finds an already open file descriptor for it and uses read()/write()/mmap()/etc - did you audit your POP server to make *really* sure that endpwent() is called at all the right times, and that said function actually is guaranteed to close() the file descriptor, and can't be forced into failing? (Note that this can be caused by either close() syscall failing, or the attacker managing to hijack the function entry point for either endpwent() or close()....)
Unless he finds a copy of the file on the process heap (more than one information leakage issue has come from THAT sort of problem)
Unless he opens a new file on the system, and writes a binary into it, chmod's it to executable, and does a pipe/fork/exec and use that program's quota of opens to read it...
And that's just the *obvious* end runs. As somebody else noted, writing the code is the easy part.... [unhandled content-type:application/pgp-signature] | |