Advice on (potential?) security problem

Thread View: comp.security.misc

5 messages

[T] Back to Threads [V] Tree View [G] Group Articles

5 total messages Started by Stephen J. Roznowski Fri, 07 Aug 1992 02:24

#108

Author: Stephen J. Roznowski
Date: Fri, 07 Aug 1992 02:24

20 lines
931 bytes

I'm busy looking for potential security holes in a suid root program.

Currently, the program does the following:

	system("/bin/stty -echo ...");

Now, I realize that the "exec-ed" program also has to be "trusted",
or there is a security hole (i.e. If I can replace /bin/stty, all
bets are off).

Now suppose that I do "all the correct things" before issuing the
"system" call (set IFS, etc.) is this worse/same as the following:

	tcgetattr(fd, &t);
	t.c_lflag &= ~ECHO;
	tcsetattr(fd, TCSANOW, &t);

Any insight is greatly appreciated.
-- 
Stephen J. Roznowski	(sjr@afterlife.ncsc.mil)

Re: Advice on (potential?) security problem

#118

Author: Rob J. Nauta
Date: Fri, 07 Aug 1992 19:11

10 lines
869 bytes

Since /bin/stty is dynamically linked in SunOS, be sure to
reset LD_LIBRARY_PATH and LD_PRELOAD before the system() call, if you
haven't installed a new su and login (I forgot the patch number).

Rob
-- 
/-----------------------------------------------\			   ,==.
| Rob J. Nauta, UNIX computer security expert.	| 			  /@  |
| rob@wzv.win.tue.nl, Phone: +31-40-837549	| 			 /_  <
| Feel free to email me for free advice		|			=" `g'

Re: Advice on (potential?) security problem

#117

Author: Valdis Kletnieks
Date: Sat, 08 Aug 1992 08:37

27 lines
1518 bytes

In article <1992Aug7.022422.9878@afterlife.ncsc.mil> sjr@afterlife.ncsc.mil (Stephen J. Roznowski) writes:
>Currently, the program does the following:
>
>	system("/bin/stty -echo ...");
>
>Now suppose that I do "all the correct things" before issuing the
>"system" call (set IFS, etc.) is this worse/same as the following:
>
>	tcgetattr(fd, &t);
>	t.c_lflag &= ~ECHO;
>	tcsetattr(fd, TCSANOW, &t);

Using 'system()' is a big loss security-wise.  You can easily
verify the security impact of an ioctl to turn on raw mode. However,
system() is open to SO many abuses it isn't funny.  For instance,
if PATH has '.' in it, you better hope your /bin/sh is one that
automatically resets IFS - otherwise, the guy can put a program
called 'bin' in the current directory, and nuke you - this was how
the infamous 'expreserve' hole worked - it did a 'system("/bin/mail"...)"

I'm sure the security mavens in this group can add another 5-6 different
ways to break a "system()" call.. ;)

				Valdis Kletnieks
				Computer Systems Engineer
				Virginia Tech

Re: Advice on (potential?) security problem

#120

Author: Casper H.S. Dik
Date: Mon, 10 Aug 1992 14:08

26 lines
1374 bytes

sjr@afterlife.ncsc.mil (Stephen J. Roznowski) writes:

>I'm busy looking for potential security holes in a suid root program.

>Currently, the program does the following:

>	system("/bin/stty -echo ...");

>Now, I realize that the "exec-ed" program also has to be "trusted",
>or there is a security hole (i.e. If I can replace /bin/stty, all
>bets are off).

>Now suppose that I do "all the correct things" before issuing the
>"system" call (set IFS, etc.) is this worse/same as the following:

>	tcgetattr(fd, &t);
>	t.c_lflag &= ~ECHO;
>	tcsetattr(fd, TCSANOW, &t);

The best things is to totally kill the environment. You'll never
no what kind of environment variables will be used for whatever purpuse
in future. Currently IFS, all variables starting with LD_ (on Suns), TERM
and PATH are the potentially dangerous ones (that I know of).
-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl

Re: Advice on (potential?) security problem

#124

Author: Rob Quinn
Date: Mon, 10 Aug 1992 18:27

12 lines
1136 bytes

In <1992Aug10.140817.20221@fwi.uva.nl> casper@fwi.uva.nl (Casper H.S. Dik) writes:
]The best things is to totally kill the environment. You'll never
]no what kind of environment variables will be used for whatever purpuse
]in future. Currently IFS, all variables starting with LD_ (on Suns), TERM
]and PATH are the potentially dangerous ones (that I know of).

 How would you use TERM? Use Curses and termcap(terminfo) 'iP' entry?

--
|                                                                Rob Quinn |
|                                                         rjq@phys.ksu.edu |
|                                                    QuinnBob@KSUVM.BITNET |

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads