Re: Samba 3.x + kernel 2.6.x local root vulnerability
From: Felipe Franciosi (ozzybugt_at_terra.com.br)
Date: 02/10/04
- Previous message: Charles Clancy: "RE: Hacking USB Thumbdrives, Thumprint authentication"
- In reply to: Michal Medvecky: "Samba 3.x + kernel 2.6.x local root vulnerability"
- Next in thread: John.Airey_at_rnib.org.uk: "RE: Samba 3.x + kernel 2.6.x local root vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 09 Feb 2004 22:07:46 -0200 To: Michal Medvecky <M.Medvecky@sh.cvut.cz>
This is old news.
NFS is also affected by this CONFIGURATION PROBLEM (not a bug). What I
think might be a problem is this:
[...took_from_mount_man...]
OPTIONS
[...]
nosuid Do not allow set-user-identifier or set-group-identifier
bits to take effect. (This seems safe, but is in fact
rather unsafe if you have suidperl(1) installed.)
[...end_of_cut...]
I have never tried to use suidperl to "exploit" such thing, but my guess
is that suidperl somehow "see" the suid bit and can execute scripts set-
uid-ing the process... or maybe the man mount page was just talking
about some old suidperl bug... if someone knows, please tell me.
Best Regards,
Felipe
-- Felipe Franciosi <ozzybugt@terra.com.br>
- Previous message: Charles Clancy: "RE: Hacking USB Thumbdrives, Thumprint authentication"
- In reply to: Michal Medvecky: "Samba 3.x + kernel 2.6.x local root vulnerability"
- Next in thread: John.Airey_at_rnib.org.uk: "RE: Samba 3.x + kernel 2.6.x local root vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
