Messages in this thread | | | Date | Fri, 23 Oct 2009 22:00:47 +0200 | From | NiTRo <> | Subject | SECURITY PROBLEM: filesystem permiossion bypass on FD already opened |
| |
Hi to all, Sorry for my bad english. Just discovered this security problem on my Suse 11 (Linux xxxx 2.6.25.18-0.2-pae #1 SMP 2008-10-21 16:30:26 +0200 i686 i686 i386 GNU/Linux) and my Slackware 10.1.0 (Linux xxxx 2.4.29-ow1 #1 Wed Feb 2 00:05:42 CET 2005 i586 unknown unknown GNU/Linux) with OpenWall patch. If a FD is opened on a allowed file and then the permission is changed the file is still redeable starting from the already read position to the EOF.
This is the scenario:
<root> creates a file /tmp/aaaa with 666 permission an with the "test" string inside it xxx:/tmp # echo test > /tmp/aaaa xxx:/tmp # chmod 666 /tmp/aaaa <sb> opens this file hooking it in a shell as FD number 3 sb@xxx:~> bash 3< /tmp/aaaa <sb> read and prints it sb@xxx:~> read a <&3 sb@xxx:~> echo $a test sb@xxx:~> ...anythig as expected... <root> changes the permissions on file to 600 and changes its content into "test o.o I cannot believe it..." xxx:/tmp # chmod 600 /tmp/aaaa xxx:/tmp # echo "test o.o I cannot believe it..." > /tmp/aaaa <sb> continue to try reading the file sb@xxx:~> read a <&3 sb@xxx:~> echo $a o.o I cannot believe it... sb@test:~> ... and this is not expected...
Writing control seems to be working fine... "bash: echo: write error: Bad file descriptor"
Hope this can help...
Thanks to all Alessandro Soraruf
| |