lkml.org 
[lkml]   [2009]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectSECURITY PROBLEM: filesystem permiossion bypass on FD already opened
Hi to all,
Sorry for my bad english.
Just discovered this security problem on my Suse 11 (Linux xxxx
2.6.25.18-0.2-pae #1 SMP 2008-10-21 16:30:26 +0200 i686 i686 i386
GNU/Linux) and my Slackware 10.1.0 (Linux xxxx 2.4.29-ow1 #1 Wed Feb 2
00:05:42 CET 2005 i586 unknown unknown GNU/Linux) with OpenWall patch.
If a FD is opened on a allowed file and then the permission is changed
the file is still redeable starting from the already read position to
the EOF.

This is the scenario:

<root> creates a file /tmp/aaaa with 666 permission an with the "test"
string inside it
xxx:/tmp # echo test > /tmp/aaaa
xxx:/tmp # chmod 666 /tmp/aaaa
<sb> opens this file hooking it in a shell as FD number 3
sb@xxx:~> bash 3< /tmp/aaaa
<sb> read and prints it
sb@xxx:~> read a <&3
sb@xxx:~> echo $a
test
sb@xxx:~>
...anythig as expected...
<root> changes the permissions on file to 600 and changes its content
into "test o.o I cannot believe it..."
xxx:/tmp # chmod 600 /tmp/aaaa
xxx:/tmp # echo "test o.o I cannot believe it..." > /tmp/aaaa
<sb> continue to try reading the file
sb@xxx:~> read a <&3
sb@xxx:~> echo $a
o.o I cannot believe it...
sb@test:~>
... and this is not expected...

Writing control seems to be working fine... "bash: echo: write error:
Bad file descriptor"

Hope this can help...

Thanks to all
Alessandro Soraruf


\
 
 \ /
  Last update: 2009-10-23 22:03    [W:0.037 / U:0.928 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site