lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: raymond at dyn.org (Raymond Morsman)
Subject: /bin/rm file access vulnerability

Citeren Lennart Hansen <xenzeo@...dener.com>:

> /bin/rm file access vulnerability

Works as designed, no vulnerability.

> When /bin/rm is called it checks the file's permissions and the id of
> the user
> trying to remove the file. If the user does not have the required
> permissions
> to delete the file, /bin/rm will simply reject and exit.

No.. It will try to remove the file and the kernel won't allow rm to
remove it.

> However, it is possible for a person with admin rights (root) to
> delete _any_ file
> on the system regardless of who has created it and what it's
> permissions are.

True, that's the meaning of root. No vulnerability here.

> $ su -c 'rm -f /home/xenzeo/file'

Switch user to root. You'll enter the root password now, right? If not,
what's the IP address of the machine? :-)

> #!/usr/bin/perl
> if ($#ARGV != 0) {
> 	die "usage: rm-exploit.pl file\r\n";

Little bit of overkill to write a perl program for some normal Unix
behaviour.

Raymond.

Powered by blists - more mailing lists