[8721] in bugtraq
Irix tape devices + logs + su
daemon@ATHENA.MIT.EDU (Harhalakis Stefanos)
Fri Dec 18 11:19:28 1998
Date: Thu, 17 Dec 1998 09:39:11 +0200
Reply-To: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
From: Harhalakis Stefanos <v13@AETOS.IT.TEITHE.GR>
To: BUGTRAQ@NETSPACE.ORG
I don't know if those are known stories.
Anyway... on Irix 6.4 the tape devices (in /hw/tape) may be created with
false permissions. I think that they are created using the current umask.
(When using su, the current umask will not change (unless there is a umask
entry in root's .cshrc)). So it is possible to have those devices with
mode 644 or even 666, which is bad news, because anyone could use
xfsrestore to get any file.
Also, /var/adm/SYSLOG contains the failed login names (even if they
don't exist) and by default, this file is forced to be mode 644 (root's
crontab will take care for this, when rotating the logs).
Finaly, when using su, the user's .cshrc will be executed with
privileges of the target user (if the su is succesful). For example,
if user nobody has a cp /bin/sh /tmp; chmod 6755 /tmp/sh in his .cshrc
and he use su to become root, a rootshell will be available in /tmp :)
This is valid only for succesfull su's
<<V13>>
