🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #63

Setuid script - is this unsecure?

#63
From: Rick Tait
Date: Tue, 03 Nov 1992 18:12
41 lines
1787 bytes
I recently installed these shell scripts on my machine (on which I am root),
and I'd like to know if I'm compromising it's security. Basically, they
just allow the users to mount/umount/eject the floppy disk (pcfs).

In: (mount script)

#!/bin/sh --
if ( test ${#} -eq 0 ) then
    /usr/etc/mount -t pcfs /dev/fd0 /pcfs
    else
       if ( test ${1} = "ro" ) then
         /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
       else
         if ( test ${1} = "rw" ) then
           /usr/etc/mount -t pcfs /dev/fd0 /pcfs
         else
           echo Invalid argument -- not mounted
         fi
       fi
fi

Out: (unmount/eject script)
#!/bin/sh --
/usr/etc/umount /pcfs
eject

So do these make my system insecure? How? How the hell would a user
turn these simple scripts over into something to compromise my IPX?

By the way, these are the directory entries:

-rwSr-xr-x  1 root     staff         368 Oct 11 11:20 in*
-rwSr-xr-x  1 root     staff          42 Oct 23 15:05 out*

Thanks in advance,

-- 
Rick M. Tait   Networking Software Engineer, Bell Northern Research (Europe)
NMBase         Internet: rickt@bnr.co.uk | ricktait@bnr.ca | R.Tait@bnr.co.uk
OSI TCP/IP     By Horse: Dept GM21, Oakleigh Road South, New Southgate, London
TLA RTFM       ICBM: 43 31N 89 12W  (No multiple-warheads please...)
Technical Details
Message-ID: <1d6fdiINNf5q@bnsgd245.bnr.co.uk>
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!agate!doc.ic.ac.uk!uknet!bnr.co.uk!stc!tcom.stc.co.uk!rickt

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!agate!doc.ic.ac.uk!uknet!bnr.co.uk!stc!tcom.stc.co.uk!rickt
From: rickt@bnr.co.uk (Rick Tait)
Newsgroups: comp.security.misc
Subject: Setuid script - is this unsecure?
Message-ID: <1d6fdiINNf5q@bnsgd245.bnr.co.uk>
Date: 3 Nov 92 18:12:02 GMT
Sender: rickt@tcom.stc.co.uk (Rick Tait)
Organization: BNR Europe Ltd, London, N11 1HB
Lines: 41
NNTP-Posting-Host: bnsgs201.bnr.co.uk