full-disclosure - Re: Symlink vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4EA9BB0B.10209@halfdog.net>
Date: Thu, 27 Oct 2011 20:11:55 +0000
From: halfdog <me@...fdog.net>
To: Andrew Farmer <andfarm@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu
Subject: Re: Symlink vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Andrew Farmer wrote:
> On 2011-10-27, at 07:48, Valdis.Kletnieks@...edu wrote:
>> The other thing that people need to remember is that there's no
>> race condition that's so small that you can't hit it.  If there's
>> a race condition, it *can* be won.
> 
> And systems like inotify make filesystem races trivial to win. I
> wouldn't be surprised if you could win this particular race
> reliably by watching for the files bzexe drops and acting
> immediately when they show up.

You might want to try out my tool from
http://www.halfdog.net/Security/2010/FilesystemRecursionAndSymlinks/
from the references section at end of the page. With appropriate
watchcount parameter, it won every race against each backup system
tested back then. As to my knowledge, only tar was fixed so far.
Running it against cpio even triggers buffer overflow, so direct root
escalation might be possible.

I haven't done proof for MS-Systems, does someone have interest in a
joint venture?

hd

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk6puu4ACgkQxFmThv7tq+71xQCfTyOcgr+LEQtiMEWSjWu5xUBK
gsIAoJHIhCSpYgMJXX/0QNV59+aXtTyz
=0Dcq
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/