Re: gzip TOCTOU file-permissions vulnerability

From: Derek Martin (code_at_pizzashack.org)
Date: 04/14/05

  • Next message: Mark Senior: "RE: gzip TOCTOU file-permissions vulnerability" 
    Date: Thu, 14 Apr 2005 12:11:06 -0400
To: bugtraq@securityfocus.com

    On Thu, Apr 14, 2005 at 09:27:11AM -0600, Mark Senior wrote:
    > > From: Derek Martin [mailto:code@pizzashack.org]
    > > Sent: April 13, 2005 08:50

    If you can, I might suggest configuring your e-mail client not to
    attribute e-mail addresses in replies (at least to mailing lists)...
    It doesn't solve the problem by any means, but it reduces the
    availability of e-mail addresses in web archives which can be
    harvested. Mailing lists can easily be configured to obscure
    addresses in their web archives, but often this doesn't extend to
    addresses posted in the body of the e-mail itself... :)

    > > The open() call is at fault here. If instead of being called
    > > with a mode of RW_USER, it is called with the final intended
    > > access mode, there is no need to later call chmod(), and the
    > > problem is averted.
    >
    > One wrinkle - if the file is not intended to have user write permission
    > on it, and gzip (unzip/cpio/pax...) initially created it with the
    > intended permissions, there would be no way to then write the file.

    Excellent point, which I overlooked. So the patch which I posted
    (whether it shows up on bugtraq is an entirely different question...)
    is worthless. Sigh. ;-) I momentarily confused root's ability to
    write to any file regardless of access permissions with a fictitious
    user ability to write to their own files, regarless of write access.
    Too bad... that ability would make for a nice solution to the problem!
    [sheepish grin]

    > The problem, to my understanding, is that the program opens the file by
    > name, then closes it, and then chmod's it, again referring to it by
    > name. During which time, as you pointed out, we could be dealing with a
    > different inode.

    Yeah, that's the problem.

    > If the program kept the file open, and used fchmod to change its
    > permissions, referring to it by file descriptor, you could be more sure
    > that it was the same inode it had just been writing to.

    That would do the trick. The question becomes one of how portable
    fchmod() is... My programming experience is unfortunately limited to
    platforms which are pretty POSIX compliant, so I can't even guess... 

    -- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

  • Next message: Mark Senior: "RE: gzip TOCTOU file-permissions vulnerability"

    Relevant Pages

    • Re: Hiding Telephone number from AD search
      ... Not only do normal users have the ability to see their telephone number, they have the ability to change it. ... It is a member of the personal information property set and that permission is granted explicitely on every user object created so inherited ACEs (permissions placed on the OU or domain structures) will not correct this. ... You could also look at the new confidentiality support in Windows Server 2003 SP1 AD. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Roamin Profiles Problem
      ... In all of these cases, the error messages usually referred to another cause (hence the 'obscure' label), at times permissions related or file system issues. ... In the large majority of incidents, these issues were due to trying to use locations that are by default secured on a domain controller and not configuring permissions correctly. ... While it is possible to resolve these issues by elevating user permissions or lowering the security profile of the DC, those are not recommended and in each of the cases I have encountered this issue, I helped clients implement a separate TS server. ...
      (microsoft.public.windows.terminal_services)
    • Managed By option doesnt let uses manage distribution list
      ... Is there a better way to allow users just the ability to manage the ... Click the Security tab, ... In the Permissions box, click Allow Read Members, and then click ...
      (microsoft.public.exchange2000.admin)
    • Re: How to assign user right to the CE-FTP server.
      ... it's not the most accurate documentation in the world, ... the permissions table, that will remain after this update. ... user account first with NTLMSetUserInfobefore configuring ... This posting is provided "AS IS" with no warranties, and confers no rights. ...
      (microsoft.public.windowsce.embedded)
    • Re: policy
      ... You need to provide permissions to users from the domain\user_name account. ... No power user or local admin group. ... ability not only can't they install programs they can't get infected with ... virus or spyware since they don't have the ability to install software ...
      (microsoft.public.windows.server.active_directory)