bugtraq - aterm 0.4.2 tty permission weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 13 Jul 2004 16:04:18 -0000
From: Maarten Tielemans <TTIelu_DaInfraCrew@...mail.com>
To: bugtraq@...urityfocus.com
Subject: aterm 0.4.2 tty permission weakness




Aterm has an issue with creating a terminal.

A quick ‘ls –al’ on a aterm with ‘mesg y’ shows:
crw--w--w-  1 alsdk  users    5,   3 Jul 13 17:27 /dev/ttyp3
with ‘mesg n’:
crw-----w-  1 alsdk  users    5,   3 Jul 13 17:28 /dev/ttyp3

1) World (nobody) is able to ‘echo’ or ‘cat’ towards the terminal
echo “hello” >> /dev/ttyp3
cat mkdir >> /dev/ttyp3 
2) The group seems to be incorrect, a normal terminal has default group tty

A xterm with ‘mesg y’ shows :
crw--w----   1 ttielu  tty         5,   5 Jul 13 17:27 ttyp5
and with ‘mesg n’ :
crw-------   1 ttielu  tty         5,   5 Jul 13 17:27 ttyp5

Advice: use xterm

Bug found by TTIelu, reverse engineered by alsdk and TTIelu