gnumake SGID: potential security hole?

Thread View: comp.security.misc

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by Alain Mellan Tue, 17 Nov 1992 12:19

#735

Author: Alain Mellan
Date: Tue, 17 Nov 1992 12:19

15 lines
924 bytes

I just discovered today that gnumake is installed with SGID bit, and
belongs to user root, group kmem.

Am I right to be suspicious ?  The kmem SGID will allow gnumake to
read into /dev/kmem the info needed for load balancing, but is that
all?



--
Alain Mellan                          
Advanced Computer Research Institute 
1 Bvd Marius Vivier Merle             voice:  (+33) 72 35 84 92         
69443 LYON CEDEX 03 - FRANCE          email:    amellan@acri.fr

Re: gnumake SGID: potential security hole?

#742

Author: Steven Bellovin
Date: Tue, 17 Nov 1992 16:51

15 lines
1263 bytes

In article <MELLAN.92Nov17131950@syst06.acri.fr>, mellan@syst06.acri.fr (Alain Mellan) writes:
> 
> I just discovered today that gnumake is installed with SGID bit, and
> belongs to user root, group kmem.
> 
> Am I right to be suspicious ?  The kmem SGID will allow gnumake to
> read into /dev/kmem the info needed for load balancing, but is that
> all?

Someone who can read /dev/kmem can also read interesting things like
typed passwords in tty input buffers, and disk blocks from read-protected
files.  I have no idea whether or not it's possible to trick gnumake
into doing those things -- for example, if it doesn't properly reset
its setgidness and close the file descriptor before execing a user program.
There's a definite risk here, if things weren't done properly.

Re: gnumake SGID: potential security hole?

#754

Author: Dave Dittrich
Date: Wed, 18 Nov 1992 21:07

21 lines
1717 bytes

smb@ulysses.att.com (Steven Bellovin) writes:

>In article <MELLAN.92Nov17131950@syst06.acri.fr>, mellan@syst06.acri.fr (Alain Mellan) writes:
>> 
>> I just discovered today that gnumake is installed with SGID bit, and
>> belongs to user root, group kmem.
>> 
>> Am I right to be suspicious ?  The kmem SGID will allow gnumake to
>> read into /dev/kmem the info needed for load balancing, but is that
>> all?

>Someone who can read /dev/kmem can also read interesting things like
>typed passwords in tty input buffers, and disk blocks from read-protected
>files.  I have no idea whether or not it's possible to trick gnumake
>into doing those things -- for example, if it doesn't properly reset
>its setgidness and close the file descriptor before execing a user program.
>There's a definite risk here, if things weren't done properly.

I guess if you are worried you should simply RTFC (after all, gnumake *is*
public domain -- but because of this fact I would doubt any security holes
would go unnoticed this long).  You could also try one of the gnu groups.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads