April 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Re: local user can delete arbitrary files on SuSE-Linux (fwd)
by Volker Kuhlmann 26 Apr '00

26 Apr '00

> Folks, do NOT use 'find' on a public directory with '-exec rm -f' as root. > Period. Ever. Delete it from your crontab *now* and finish reading the One of the systems here uses this, started from (essentially) /etc/csh.logout: #!/bin/sh sleep 600 /bin/find /tmp -mount -depth -user ${USER} $ -type f -o -type l $ \ -mtime +7 -exec rm {} ';' The thing I like is that it runs as user, not root. It could probably be improved a bit; as a basic idea, would it be possible to run rm with euid of the entry to be deleted, from cron? Volker

1 0

Re: local user can delete arbitrary files on SuSE-Linux (fwd)
by Peter Münster 25 Apr '00

25 Apr '00

Excuse-me please! It seems, that my little patch was not a so good idea! So, thanks to Pavel Kankovsky and to James Antill! Peter -- Peter Münster http://gmv.spm.univ-rennes1.fr/~peter/ ---------- Forwarded message ---------- Date: Sun, 23 Apr 2000 00:03:04 +0200 From: Pavel Kankovsky <peak(a)ARGO.TROJA.MFF.CUNI.CZ> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: Re: local user can delete arbitrary files on SuSE-Linux On Fri, 21 Apr 2000, [ISO-8859-1] Peter Münster wrote: > If MAX_DAYS_IN_TMP > 0 in /etc/rc.config on a SuSE-Linux system, a local > user can delete arbitrary files by doing some commands like these: > mkdir -p "/tmp/hhh /somedirectory" > touch -t some-early-date "/tmp/hhh /somedirectory/somefile" > sleep 1d ... > Here a possible patch for suse-package aaa_base-2000.1.3-0: ... > + find $TMP_DIR/. $OMIT ! -type d \ > + -atime +$MAX_DAYS_IN_TMP -exec rm -f '{}' ';' > + find $TMP_DIR/. $OMIT -depth -type d -empty -mindepth 1 \ > + -mtime +$MAX_DAYS_IN_TMP -exec rmdir '{}' ';' mkdir -p /tmp/somedirectory/{_junk,bin} fill_with_lots_of_junk_to_slow_find_down /tmp/somedirectory/_junk find /tmp/somedirectory -type f | xargs touch -t some-early-date touch -t some-early-date /tmp/somedirectory/bin/sh wait_until_aaa_base_starts_searching /tmp/somedirectory/_junk mv /tmp/somedirectory /tmp/somedirectory2 ln -s / /tmp/somedirectory watch /bin/sh disappear...this will teach you not to use find and rm to clean /tmp :) --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation." ---------- Forwarded message ---------- Date: 21 Apr 2000 16:20:24 -0400 From: James Antill <james(a)and.org> To: Peter Münster <peter(a)gmv.spm.univ-rennes1.fr> Cc: security(a)suse.com Subject: Re: local user can delete arbitrary files on SuSE-Linux Peter Münster <peter(a)GMV.SPM.UNIV-RENNES1.FR> writes: > Hello, > If MAX_DAYS_IN_TMP > 0 in /etc/rc.config on a SuSE-Linux system, a local > user can delete arbitrary files by doing some commands like these: > mkdir -p "/tmp/hhh /somedirectory" > touch -t some-early-date "/tmp/hhh /somedirectory/somefile" > sleep 1d > > The bug is in /etc/cron.daily/aaa_base for SuSE version 6.3 or perhaps > also in /root/bin/cron.daily for older SuSE versions. > Tested on SuSE 6.0 and 6.3 but probably existent on earlier versions. > > Here a possible patch for suse-package aaa_base-2000.1.3-0: > > --- aaa_base~ Mon Jan 3 18:16:55 2000 > +++ aaa_base Fri Apr 21 08:42:19 2000 > @@ -158,20 +158,10 @@ > done > > for TMP_DIR in $TMP_DIRS_TO_CLEAR ; do > - for DEL_FILE in `find $TMP_DIR/. $OMIT $ -type f -o -type l $ \ > - -atime +$MAX_DAYS_IN_TMP | sort -r` ; do > - rm -f $DEL_FILE > - DEL_DIR=`dirname $DEL_FILE` > - if [ "$DEL_DIR" != "$TMP_DIR/." ] ; then > - rmdir $DEL_DIR 2> /dev/null > - fi > - done > - done Oh dear :O ... apart from the above flaw (--print0 anyone) above this is _very_ raceable by doing... mkdir -p /tmp/blah/1 mkdir -p /tmp/blah/2 mkdir -p /tmp/blah/3 Do the above a couple of thousand times... touch /tmp/blah/199/passwd wait for the find part of the script to come along... mv /tmp/blah/199 /tmp/blah/.199 && ln -s /etc /tmp/blah/199 > - for DEL_DIR in `find $TMP_DIR/. $OMIT $ -type d $ \ > - -ctime +$MAX_DAYS_IN_TMP | sort -r` ; do > - if [ "$DEL_DIR" != "$TMP_DIR/." ] ; then > - rmdir $DEL_DIR 2> /dev/null > - fi > + find $TMP_DIR/. $OMIT ! -type d \ > + -atime +$MAX_DAYS_IN_TMP -exec rm -f '{}' ';' > + find $TMP_DIR/. $OMIT -depth -type d -empty -mindepth 1 \ > + -mtime +$MAX_DAYS_IN_TMP -exec rmdir '{}' ';' > done > fi This doesn't fix it either, it just makes the race smaller. -- James Antill -- james(a)and.org "If we can't keep this sort of thing out of the kernel, we might as well pack it up and go run Solaris." -- Larry McVoy.

2 2

Re: SuSE Firewall 2.3: no difference between internal and external?
by marc＠suse.de 24 Apr '00

24 Apr '00

Hi, >I've setup SuSEfirewall like this: - there are no services accesible from >the internet - from the internal network, only SSH and SAMBA is allowed - >the rest ispretty obvious; autoprotect global services is set to yes, >protect from internal also. I wanted to test the firewall and went to >hackerwacker.com and according to them SSH is accesible from the internet >and that does not suppose to happen right? I can get a fine ssh connection >if I try to connect to the machine from the LAN to the IP adress from my >provider also. Is this a bug, or am I missing the obvious here? well, if you don't provide your firewall.rc.config file it's hard to guess what went wrong ;-) what you can try: "SuSEfirewall open" shows you services which are reachable (unprotected). well, send me the config file plus the output of "SuSEfirewall status" (to marc(a)suse.de) if the problem persists. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

hole at 6.3 (YP/KDM)
by Rupert Koenig 24 Apr '00

24 Apr '00

Hi folks! There seems to be a security-problem in suse 6.3 - i've got running a server (6.3) which provides a YP-server. Now i created some new users at this server with login-shell /bin/false. These users are exportet via YP to my workstation (6.3). So far so good - if I try to login on my workstation with one of these users via telnet or at the console, the login fails - as it should be because of /bin/false. But if I try to log in at KDM a login is possible!! In deed, this is not possible for all WM's, but e.g. with fvwm2 - it starts and I can start a x-term for this user!! Other WM's like KWM don't start completle, probably because there is no home-dir for these users at my workstation. Is this a problem of KDM or perhaps of YP? Would be great if anybody could tell me if he/she has the same problem bye Rupert

2 1

SuSE Firewall 2.3: no difference between internal and external?]]
by Frank Hart 24 Apr '00

24 Apr '00

1 0

Re: local user can delete arbitrary files
by marc＠suse.de 23 Apr '00

23 Apr '00

Hi, thanks for reporting this vulnerability, we will provide a fix asap. As a temporary solution, please set MAX_DAYS_IN_TMP in /etc/rc.config to 0. Please remember: always send vulnerability reports to security(a)suse.de (if you want to use pgp, get the public pgp key from www.suse.de/security - the finger print can be found at the end of the chapter "Security" of the SuSE Linux Book) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

2 1

Re: imapd4r1 v12.264 and Security Implications
by marc＠suse.de 23 Apr '00

23 Apr '00

Hi, >> Slightly off topic, but I've been hearing on and off about >> automated apps that search c source code for "gross violations" of a >> security nature (improper buffer checking comes to mind here) in the so >> called underworld. >> Is there such a thing, and would it be something that SuSE would >> provide for all the folk who don't necessarily use RPMs for everything? > >I think you may be referring to Slint. See: http://www.lopht.com/slint.html slint is vaporware and does not exist. the l0pht guys announced it - I think - 2 years ago, and every year I'm trying again to buy it (it's payware) but I get always the same reply: "it's not there yet, we will contact you when it's ready" ... *sigh* sourcecode audits are not easy to do by a tool anyway. programs are that complex that you need a human being to see through it. tools can only help/support. Greets, Marc -- E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Re: imapd4r1 v12.264 and Security Implications
by marc＠suse.de 23 Apr '00

23 Apr '00

>> > (there are far too much packages to remember them all ;-))). Let's hope that >> > the code of that one is better ... well, time to do a sourcecode audit :( >> > *sigh* >> Slightly off topic, but I've been hearing on and off about >> automated apps that search c source code for "gross violations" of a >> security nature (improper buffer checking comes to mind here) in the so >> called underworld. > >Well, do you mean tools such as ITS4 (http://www.rstcorp.com/its4/), which >may help you doing an security audit. But I do not have any experiences with it. >Marc? Thomas? I checked it out and it is not that useful, because too many false alarms are generated and it does only check for a small portion of vulnerability types. And it's something Thomas and my scripts are already doing as well. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Re: XFree86 xkbmap parameter buffer overflow
by marc＠suse.de 23 Apr '00

23 Apr '00

Hi, > XFree86 versions 3.3.5 and 3.3.6 have been found to contain a buffer > overflow in the xkbmap command-line switch. An attacker can execute > arbitrary code as root, since XFree86 runs either with setuid permissions, > or via a wrapper that is setuid. please note SuSE Linux is not exploitable. The Xwrapper which comes with SuSE 6.4 is suid but checks the arguments and prevents this attack. The X Servers are not suid. Therefore: no problem. BUT if you have installed XFree86 4.0 (SuSE 6.4 installs 3.3.6) you are vulnerable. Check it out by executing the following command: "rpm -q xf86" Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

imwheel is not vulnerable
by marc＠suse.de 21 Apr '00

21 Apr '00

Please note that a local root vulnerability has been found in the imwheel package, however: SuSE Linux is not affected We dont ship the vulnerable suidperl script. >From the /usr/doc/packages/imwheel/README.SuSE file: For security reasons suid root installation as mentioned in the README file is disabled in the distribution. If you terminate/restart the X-Server all running instances of imwheel are killed anyway. Thank you for your attention. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0