[13549] in bugtraq
Re: Solaris 7 and solaris 8 file permissions
daemon@ATHENA.MIT.EDU (Casper Dik)
Mon Jan 24 23:26:46 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <200001240906.KAA20082@romulus>
Date: Mon, 24 Jan 2000 10:06:57 +0100
Reply-To: Casper Dik <casper@HOLLAND.SUN.COM>
From: Casper Dik <casper@HOLLAND.SUN.COM>
X-To: Steve Dispensa <steve@mwis.net>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: Your message of "Sat, 22 Jan 2000 13:52:21 CST."
<006601bf6512$3322d240$1300000a@mwis.net>
>pa:/var/adm$ ls -ld spellhist
>-rw-rw-rw- 1 bin bin 0 Dec 15 07:28 spellhist
The purpose of the spellhist file is to record all mispellings by all
users. This file is supposed to be worldwritable.
"chmod 644 /var/adm/spellhist" will cause this:
spell
tee: /var/adm/spellhist: Permission denied
Of course, this feature of spell is highly questionable ($HOME/.spellhist)
would appear to be more reasonable.
>pa:/var/adm$ ls -ld vold.log
>-rw-rw-rw- 1 root root 3063 Jan 22 00:48 vold.log
The default umask of 0 causes this; in Solaris 8 the default umask is 022.
>
>There are dangerous write permissions on logging files in Solaris 7 and
>Solaris 8. In Solaris 8, the issue with vold.log has been
>corrected. The spellhist file, however, still uses the same permissions as
>Solaris 7 did. Granted this issue wont result in a root
>compromise it does allow for users to fill up the /var partition without
>having root access.
>
>(Yes, I know /var/tmp exists and would allow for the same thing.)
>
>Solution:
>
>Have SUN distributed Solaris 8 with the permissions fixed on the spellhist
>file or rely on the administrators of the systems to fix the permissions
>themselves.
Since /var/tmp, /var/mail and other files are writable in /var, it's always
possible to overflow /var. (Atjobs probably have no size limit either).
Casper
