Article View: comp.security.misc
Article #742Re: gnumake SGID: potential security hole?
From: Steven Bellovin
Date: Tue, 17 Nov 1992 16:51
Date: Tue, 17 Nov 1992 16:51
15 lines
1263 bytes
1263 bytes
In article <MELLAN.92Nov17131950@syst06.acri.fr>, mellan@syst06.acri.fr (Alain Mellan) writes: > > I just discovered today that gnumake is installed with SGID bit, and > belongs to user root, group kmem. > > Am I right to be suspicious ? The kmem SGID will allow gnumake to > read into /dev/kmem the info needed for load balancing, but is that > all? Someone who can read /dev/kmem can also read interesting things like typed passwords in tty input buffers, and disk blocks from read-protected files. I have no idea whether or not it's possible to trick gnumake into doing those things -- for example, if it doesn't properly reset its setgidness and close the file descriptor before execing a user program. There's a definite risk here, if things weren't done properly.
Technical Details
Message-ID:
<1992Nov17.165157.6769@ulysses.att.com>Path:
arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!pacific.mps.ohio-state.edu!linac!att!att!dptg!ulysses!ulysses!smbReferences:
<MELLAN.92Nov17131950@syst06.acri.fr>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!pacific.mps.ohio-state.edu!linac!att!att!dptg!ulysses!ulysses!smb From: smb@ulysses.att.com (Steven Bellovin) Subject: Re: gnumake SGID: potential security hole? Message-ID: <1992Nov17.165157.6769@ulysses.att.com> Date: Tue, 17 Nov 1992 16:51:57 GMT References: <MELLAN.92Nov17131950@syst06.acri.fr> Organization: AT&T Bell Laboratories Lines: 15