full-disclosure - Re: Windows XP bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 8 Jul 2010 13:37:40 +0200
From: Robert Święcki <robert@...ecki.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows XP bug

> But, there is difference with evaluation/calculation in windows and linux.
> Here is how...

It rather depends on where the path evaluation takes place - kernel vs
userland. It might also depend on whether 'cd' checks explicitly for
existence of path elements (bash's cd does)

> one@...ntubox:~$ cd thisdoesntexist/
> -bash: cd: thisdoesntexist: No such file or directory
> one@...ntubox:~$ cd thisdoesntexist/../
> -bash: cd: thisdoesntexist/../: No such file or directory
> one@...ntubox:~$

$ pwd
/tmp

$ ln -s /usr/share a
$ cd a/..
$ pwd
/tmp

$ cd -P a/..
$ pwd
/usr

syscall trace for the case 1.

chdir("/tmp")     (path is being resolved in userland)

for the case 2.

chdir("a/..")      (path is being resolved in kernel)

PS. While we are at this subject: if you ever dreamt of
non-shell-built-in 'cd' command, I recommend checking out this one -
http://www.swiecki.net/red/progs/extcd.c

-- 
Robert Święcki

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/