full-disclosure - Re: Symlink vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCvwp7QZ5S=K8sM=Tuk7rXXECme5W9Ja3Tn7-eCaRNZXY0ByA@mail.gmail.com>
Date: Fri, 28 Oct 2011 11:46:52 +1100
From: GloW - XD <doomxd@...il.com>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Symlink vulnerabilities

Yes... even adding a cron entry is possible if done right ;)


On 28 October 2011 04:51,  <Valdis.Kletnieks@...edu> wrote:
> On Thu, 27 Oct 2011 10:31:12 PDT, Andrew Farmer said:
>> And systems like inotify make filesystem races trivial to win. I
>> wouldn't be surprised if you could win this particular race reliably by
>> watching for the files bzexe drops and acting immediately when they show
>> up.
>
> Good point.  That actually has multiple benefits - first off, you don't have a
> 'while (1)' loop in your code that's easily spotted on a 'ps' or 'top'.  So you
> can afford to set the inotify and wait (potentially days, if needed) with less
> chance of detection.  And then when the inotify pops and tells you your file is
> ready to be exploited, the circumstances of returning from the blocked syscall
> will tend to give your process a scheduling boost, improving your chances of
> winning the race because you'll schedule soon.
>
> It's amazing how many optimizations people are coming up for a vulnerability
> that some were saying is impossible to exploit. ;)
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/