lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4EA9BB0B.10209@halfdog.net> Date: Thu, 27 Oct 2011 20:11:55 +0000 From: halfdog <me@...fdog.net> To: Andrew Farmer <andfarm@...il.com> Cc: full-disclosure@...ts.grok.org.uk, Valdis.Kletnieks@...edu Subject: Re: Symlink vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Andrew Farmer wrote: > On 2011-10-27, at 07:48, Valdis.Kletnieks@...edu wrote: >> The other thing that people need to remember is that there's no >> race condition that's so small that you can't hit it. If there's >> a race condition, it *can* be won. > > And systems like inotify make filesystem races trivial to win. I > wouldn't be surprised if you could win this particular race > reliably by watching for the files bzexe drops and acting > immediately when they show up. You might want to try out my tool from http://www.halfdog.net/Security/2010/FilesystemRecursionAndSymlinks/ from the references section at end of the page. With appropriate watchcount parameter, it won every race against each backup system tested back then. As to my knowledge, only tar was fixed so far. Running it against cpio even triggers buffer overflow, so direct root escalation might be possible. I haven't done proof for MS-Systems, does someone have interest in a joint venture? hd - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk6puu4ACgkQxFmThv7tq+71xQCfTyOcgr+LEQtiMEWSjWu5xUBK gsIAoJHIhCSpYgMJXX/0QNV59+aXtTyz =0Dcq -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists