bugtraq - Re: aterm 0.4.2 tty permission weakness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040714095919.GB1530@phoenix.fire.galaxy.universe>
Date: Wed, 14 Jul 2004 11:59:19 +0200
From: Sebastian Hans <hanss@...tum.de>
To: bugtraq@...urityfocus.com
Subject: Re: aterm 0.4.2 tty permission weakness

Maarten Tielemans wrote:
> 
> 
> Aterm has an issue with creating a terminal.
> 
> A quick ?ls ?al? on a aterm with ?mesg y? shows:
> crw--w--w-  1 alsdk  users    5,   3 Jul 13 17:27 /dev/ttyp3
> with ?mesg n?:
> crw-----w-  1 alsdk  users    5,   3 Jul 13 17:28 /dev/ttyp3
> 
> 1) World (nobody) is able to ?echo? or ?cat? towards the terminal
> echo ?hello? >> /dev/ttyp3
> cat mkdir >> /dev/ttyp3 
> 2) The group seems to be incorrect, a normal terminal has default group tty

When using devpts, it looks good:

$ mesg
is y
$ ls -Al /dev/pts/0
crw--w----  1 phi xxx 136, 0 Jul 14 11:25 /dev/pts/0
$ mesg n
$ ls -Al /dev/pts/0
crw-------  1 phi xxx 136, 0 Jul 14 11:26 /dev/pts/0

Cheers

Seb
-- 
/~\ The ASCII                                             Sebastian Hans
\ / Ribbon Campaign                                      hanss@...tum.de
 X  Against HTML                                              0x5AED1E6D
/ \ Email!            014C 4A54 FED4 C0B5 3E87  427B 6910 AB0A 5AED 1E6D

Content of type "application/pgp-signature" skipped