[1529] in linux-security and linux-alert archive
[linux-security] Re: Re: Re: Yet Another DIP Exploit?
daemon@ATHENA.MIT.EDU (Mouring Cat)
Mon May 5 07:17:08 1997
Date: Sun, 4 May 1997 12:06:02 -0400 (EDT)
From: Mouring Cat <mouring@sarah.djmix.com>
To: linux-security@redhat.com
In-Reply-To: <9705040229.AA35570@hawpub.watson.ibm.com>
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
On Sat, 3 May 1997, Uri Blumenthal wrote:
> Rogier Wolff says:
> > We're getting conflicting reports "it works for me" and "i can't
> > reproduce the bug". Alex says it is an old one as well.
> > Lets keep in mind that:
> > - Program writers should NEVER recommend making their programs
> > setuid as an easy way to allow non-root users to use their program
> > unless they have taken extreme measures to prevent exploits.
>
> This program *must* run set-uid root. The measures *were* taken to
> prevent several exploits.
>
I guess they were not enough.
> > - Some distributions may remove setuid bits to improve security.
> > My Red Hat 4.0 and 3.0.3 systems both don't have setuid bits on
> > dip.
>
> Stupid.
>
RedHat does not turn the setuid bit on dip for the fact that not everyone
is running dip as a dialin. I only know of *ONE* ISP that is using
dip or some such software to do PPP logins.
Thus, if 99.9% of the population is using dip for dialout..Why setuid
it? The .1% are fokes that know what they are doing and they can figure
out to setuid it.
> > Suggestions for patching dip? OK.
> > Why is dip setuid? To add routes and stuff? OK. So make sure that
> > it exchanges real and effective uid in all other code-pieces.
> > This does NOT protect against buffer overrun exploits.
>
> I'm sorry but from this it is obvious you know less than nothing
> about DIP internals. Feel free to look at the sources, or to
> refrain from comments on something outside your area of
> expertise.
I'm sorry I read this mail. =( I assume that you and others within the
Linux world are a bit more forgiving and explain why things are setuid.
Remember this ain't microsoft. Lot of us don't follow blindly.
Besides adding route why is dip setuid?
Ben Lindstrom
http://www.djmix.com/~mouring/
