mounting security leak

Thread View: comp.security.misc

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by Gerhard den Hollander Thu, 06 Aug 1992 13:30

#105

Author: Gerhard den Hollander
Date: Thu, 06 Aug 1992 13:30

16 lines
779 bytes

I have the following problem,

I have a machine which (auto)mounts an other machine
[different vendor, different processor etc..]

Now I have a Root-shell ( meaning program owned by root with srwxrwxrw) 
on machine A.`

If machine B mounts machine A,
I can execute (on machine B) my root-script on machine A
meaning I am root on machine B.

How can I prevent this ????
Mounting with the nosuid option does NOT work.

Please help.

Re: mounting security leak

#109

Author: Alan J Rosenthal
Date: Fri, 07 Aug 1992 03:10

24 lines
1606 bytes

holland@dutiws.tudelft.nl (Gerhard den Hollander) writes:
>If machine B mounts machine A,
>I can execute (on machine B) my root-script on machine A
>meaning I am root on machine B.

Generally speaking, if you import information at this kind of security level,
the source had better be trustworthy.  Even if you allow users to mount floppy
disks, they can edit them with a sector editor on their own machine (esp. the
same kind of machine running a different OS, like a mac running mac OS if we're
talking about an a/ux disk) and create setuid shells.

>How can I prevent this ????
>Mounting with the nosuid option does NOT work.

Do you mean it's not implemented on your system (quite common), or that it
fails to perform the documented function?  What kind of system is it?

Nosuid isn't good enough, though.  For example, people can still create device
files and mount them.  Being able to write /dev/kmem should be good enough to
get you in, and all you have to do (on "machine A") is mknod myfile c 3 1;
chmod 666 myfile.  Also, you may have root-run programs which "trust" files on
some filesystems imported from machine A; or for that matter, if you're root on
machine A you can edit any non-root file it imports (how to do this is left as
an exercise for the reader).

Re: mounting security leak

#115

Author: Alan Cox
Date: Fri, 07 Aug 1992 12:35

12 lines
1021 bytes

Mounting NFS files is very much making the machines sharing the filestore
as vunerable as the weakest of the two. Especially dangerous is mounting
user file store across NFS. A hack to root on one machine lets you add
a suitable .forward file to the home directory of a target on the other 
machine and mail them - you are now pretty close to breaking both machines
even without access to anything but that users file store on the remote.
This can be applied using ftp to attack machines with no incoming
telnet/rlogin - all you need is a password, ftp and smtp.
The sendmail .forward is very powerful but very very dangerous...

Alan

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads