Re: RAZOR advisory: Linux util-linux chfn local root vulnerability

From: Andrew Pimlott (andrew@pimlott.net)
Date: 07/30/02 

Date: Tue, 30 Jul 2002 10:48:31 -0400
To: Michal Zalewski <lcamtuf@bos.bindview.com>
From: Andrew Pimlott <andrew@pimlott.net>

On Tue, Jul 30, 2002 at 09:59:36AM -0400, Michal Zalewski wrote:
> On Tue, 30 Jul 2002, Andrew Pimlott wrote:
>
> > If he is smart, he will check whether the file is open (eg with fuser)
> > before removing it. So your attack does require an administrator
> > mistake.
>
> Not really. The file does not have to be open to be present in the system.
> It is prefectly possible to leave a dangling root-owned file several
> times, so that the administrator can do very little to determine where it
> came from.

Correct, but: the admin should still verify that it is not open
before deleting it (in his cron job). IOW, when the file is present
but not open, the admin has no way to trace it, but at least
removing it is harmless. When the file is present and open, the
clever admin will not only foil your exploit (by not removing the
file), but find the culprit (via fuser).

Maybe this is assuming too much prescience from the admin, but I
don't think so. After all, an open /etc/ptmp could well be involved
in a legitimate chfn, and the admin wouldn't want to disrupt that.

Andrew

Relevant Pages

  • By-pass security settings on a standalone computer
    ... access to the other admin account). ... I did mention the the boss about being able to do things if there was ... > changing or removing the Admin password does remove access for the = ...
    (microsoft.public.windowsxp.security_admin)
  • Re: More than one Administrator Account and Reinstalling OS on a D
    ... The other roles you describe (Enter Admin, Domain Admin etc) do exist, but ... Are these in AD Users and Computers because I have 2 domain controllers ... Also, how do I check if the DC I am removing is the Global Catalog, and am I ... > With the admin accounts, which two are you referring to? ...
    (microsoft.public.win2000.active_directory)
  • New Hardrive...
    ... There was two accounts running... ... Password protected (admin) and one guest. ... way out of that situation without removing the hard ... drives and removing the password on my account? ...
    (microsoft.public.windowsxp.security_admin)
  • Can not remove printer
    ... If this is a work computer I strongly suggest you have ... the IT admin look into this as the admin may have built ... install/uninstall rules which you are not able to do as ... >Having touble removing a printer installed from active ...
    (microsoft.public.windowsxp.general)