lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 Oct 2011 20:54:49 +0200
From: vladz <vladz@...zero.fr>
To: Tavis Ormandy <taviso@...xchg8b.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Symlink vulnerabilities


Hi, 

On Tue, Oct 25, 2011 at 12:06:25PM +0200, Tavis Ormandy wrote:
> xD 0x41 <secn3t@...il.com> wrote:
> >     Your 'race condition possibly leading to root'is a myth...
> > Yes thats maybe because race condition or not, it is ASLR wich will
> > prevent from ANY rootshell,and Yes, it has bveen tried... You can do
> > better, go right ahed ;-) I am betting you thats why it aint being ptached
> > in any hurry, because obv if you read some notes about it in the committs,
> > you will see they must have reproduced the said bugs, in and with, more
> > than JUST bzexe even... but anyhow, your PoC is bs.
> 
> I think you misunderstood, he's not talking about memory corruption, his
> attack sounds like a legitimate filesystem race. I'll try to explain, the
> bzexe utility compresses executables and then decompresses them at runtime
> by prepending a decompression stub.

Thank you for explaining him, I thought he was not replying to the good
thread.

> I think it's quite a nice example, and a nice simple solution. Imagine a
> system where crond executes a bzexe utility at regular intervals, Vladz'
> attack will eventually succeed.

Even if bzexe is not used that much, I found similar configurations
(compressed binaries launched via crond) on embedded systems (I think
this is why bzexe was made for).

vladz.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists