Re: tar/security best practice (was Re: RE: Is FreeBSD's tar susceptible to this?)

From: f.johan.beisser (jan@caustic.org)
Date: 10/02/02 

Date: Tue, 1 Oct 2002 16:25:57 -0700 (PDT)
From: "f.johan.beisser" <jan@caustic.org>
To: Brett Glass <brett@lariat.org>

On Tue, 1 Oct 2002, Brett Glass wrote:

> There are dozens of ways that it can. Think ~/.forward with a piped
> command, for example.

sadly, i have to admit that won't work, not without adding in the leading
"/". remember that "~" is expanded to "/home/$USER". if you can presume
your victim will execute from a specific directory - say "/home/foo/tmp"
- you could include "./../../.forward" inside a subdirectory. but, what's
the guantee that they will be that consistant?

assuming they're untarring in /usr/tmp, /var/tmp, or /tmp will also not
really work, unless you're attacking a specific victim, and have
pre-existing knowledge of their machines setup.

while i do see this as being exploitable, i don't see it being something
that can't be overcome by education and warning.

-------/ f. johan beisser /--------------------------------------+
  http://caustic.org/~jan jan@caustic.org
    "John Ashcroft is really just the reanimated corpse
         of J. Edgar Hoover." -- Tim Triche

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Interface
    ... I do admit that magic is useful, however, there's generally so much to chose ... from and so little space in which to keep it (that process called "spell ... > ^u is not unused in the roguelike command set. ... Well, if one is not modding the roguelike keyset, then one is not modding ...
    (rec.games.roguelike.angband)
  • Re: PLEASE!! How can I un-grey the Data-Import External Data-Import Data option ???
    ... able to use that command. ... I must admit to being very pissed off with this. ... wasted because this STOOPID bloody thing suddenly occured for no ... Bugger Bill Gates is all I ...
    (microsoft.public.excel.programming)
  • how does pipe data chunking work?
    ... Have to admit I'm not clear on this one.. ... what determines how often the output of the first program is sent ... It seems that with a command like: ...
    (comp.os.linux.development.system)
  • Chung has NO balls!
    ... Still won't admit he lied. ... >> Did not attempt exorcism. ... "In the infinitely powerful and holy name of LORD Jesus Christ, ... command you, demon, to come out and leave Philip before our LORD ...
    (sci.med.cardiology)