full-disclosure - Linux Kernel 2.6.x PRCTL Core Dump Handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri Jul 14 00:55:22 2006
From: perfect.material at gmail.com (PERFECT.MATERIAL)
Subject: Linux Kernel 2.6.x PRCTL Core Dump Handling -
	simple workaround

Matt Murphy write:
>If you actually bothered to read ANY of the vendor advisories on this
>issue, you'd know why.  The vulnerability exists because the kernel
>DOES NOT VERIFY write permissions to core dump directories.  If your
>users actually have write permissions to /etc/cron.d, do the world a
>favor and disconnect from the internet as soon as humanly possible.

I think the nigger is calling the kettle a junglebunny here. Do you know
how CHDIR(2) works Matthew Murphy? Try to CHDIR(2) into a directory to
which you do not have execute privileges!!!

PERFECT.MATERIAL
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060713/b7d03744/attachment.html