full-disclosure - /bin/rm file access vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1104405342.41d3e35e5093c@service.dyn.org>
From: raymond at dyn.org (Raymond Morsman)
Subject: /bin/rm file access vulnerability

Citeren Lennart Hansen <xenzeo@...dener.com>:

> /bin/rm file access vulnerability

Works as designed, no vulnerability.

> When /bin/rm is called it checks the file's permissions and the id of
> the user
> trying to remove the file. If the user does not have the required
> permissions
> to delete the file, /bin/rm will simply reject and exit.

No.. It will try to remove the file and the kernel won't allow rm to
remove it.

> However, it is possible for a person with admin rights (root) to
> delete _any_ file
> on the system regardless of who has created it and what it's
> permissions are.

True, that's the meaning of root. No vulnerability here.

> $ su -c 'rm -f /home/xenzeo/file'

Switch user to root. You'll enter the root password now, right? If not,
what's the IP address of the machine? :-)

> #!/usr/bin/perl
> if ($#ARGV != 0) {
> 	die "usage: rm-exploit.pl file\r\n";

Little bit of overkill to write a perl program for some normal Unix
behaviour.

Raymond.