Re: [Full-Disclosure] /bin/rm file access vulnerability

From: Jörg Eschke (joerg_at_eschke.net)
Date: 12/30/04

  • Next message: Joxean Koret: "[Full-Disclosure] Two Vulnerabilities in ViewCVS" 
    To: Lennart Hansen <xenzeo@gardener.com>
Date: Thu, 30 Dec 2004 12:44:59 +0100

    Sure, a user with admin rights is able to access/delete every local
    file, regardless of the specific filepermissions.
    Your 'exploit' will work with e.g. /bin/cat as well.
    But i can't see a vulnerability anyway.

    Am i missunderstanding something ?

    Am Do, den 30.12.2004 schrieb Lennart Hansen um 2:18:
    > /bin/rm file access vulnerability
    >
    > Affected Products:
    > /bin/rm (all versions, tested on FreeBSD and linux)
    > (http://www.freebsd.org http://www.kernel.org)
    >
    > Author:
    > Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
    > xenzeo at blackhat dot dk
    >
    >
    > /bin/rm is a program that removes the named file arguments on unix systems.
    > When /bin/rm is called it checks the file's permissions and the id of the user
    > trying to remove the file. If the user does not have the required permissions
    > to delete the file, /bin/rm will simply reject and exit.
    >
    > However, it is possible for a person with admin rights (root) to
    > delete _any_ file
    > on the system regardless of who has created it and what it's permissions are.
    >
    > Proof of concepts:
    > $ touch /home/xenzeo/file
    > $ ls -l /home/xenzeo/file
    > -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file
    > $ id
    > uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
    > $ su -c 'rm -f /home/xenzeo/file'
    > $ ls -l /home/xenzeo/file
    > ls: file: No such file or directory
    >
    > #!/usr/bin/perl
    > if ($#ARGV != 0) {
    > die "usage: rm-exploit.pl file\r\n";
    > } else {
    > $file = $ARGV[0];
    > print "*** CMD: [ /bin/rm -f $file ]\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > if ($> == 0) {
    > print "[-] EXECUTING CMD\r\n";
    > system("/bin/rm -f $file");
    > print "[-] DONE\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > exit();
    > } else {
    > print "[-] EXPLOIT FAILED\r\n";
    > print "[-] YOU ARE NOT ROOT\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > }
    > }
    >
    > Vender status:
    > Neither FreeBSD nor Linux developers have been contacted yet!
    >
    > -Xenzeo

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Joxean Koret: "[Full-Disclosure] Two Vulnerabilities in ViewCVS"
    • Quantcast