full-disclosure - Re: Symlink vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20933.1319728226@turing-police.cc.vt.edu>
Date: Thu, 27 Oct 2011 11:10:26 -0400
From: Valdis.Kletnieks@...edu
To: bugs@....dhs.org
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Symlink vulnerabilities

On Thu, 27 Oct 2011 10:39:46 EDT,somebody before bugs@....dhs.org said:
> > I still think its crap anyhow, so, enjoy your 60% chance s[ploit on,
> > whats not going to be a recent 2011 kernel :)

Whoever wrote this should stop and ponder a bit - how does the kernel release
enter into it?  The exploit depends on several *userspace* processes issuing
totally legal system calls in an unfortunate, but legal, order.  There's no
"pass the kernel a funky ioctl structure" or other "abuse the kernel" going on
that may have been patched between the ancient 2.6.18 that some distros used as
a base for still-supported releases, and the current 3.1.  If this sort of
userspace bug worked back on an old system with an old kernel, it should still
work now. As several people have pointed out already, the right place to fix
this is in userspace - either by whack-a-mole patching of gxexec, or by
deploying a polyinstantiation solution of some sort.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/