[35730] in bugtraq
Re: aterm 0.4.2 tty permission weakness
daemon@ATHENA.MIT.EDU (Sebastian Hans)
Thu Jul 15 20:20:56 2004
Date: Wed, 14 Jul 2004 11:59:19 +0200
From: Sebastian Hans <hanss@in.tum.de>
To: bugtraq@securityfocus.com
Message-ID: <20040714095919.GB1530@phoenix.fire.galaxy.universe>
Mail-Followup-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="f2QGlHpHGjS2mn6Y"
Content-Disposition: inline
In-Reply-To: <20040713160418.14262.qmail@www.securityfocus.com>
--f2QGlHpHGjS2mn6Y
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Maarten Tielemans wrote:
>=20
>=20
> Aterm has an issue with creating a terminal.
>=20
> A quick ?ls ?al? on a aterm with ?mesg y? shows:
> crw--w--w- 1 alsdk users 5, 3 Jul 13 17:27 /dev/ttyp3
> with ?mesg n?:
> crw-----w- 1 alsdk users 5, 3 Jul 13 17:28 /dev/ttyp3
>=20
> 1) World (nobody) is able to ?echo? or ?cat? towards the terminal
> echo ?hello? >> /dev/ttyp3
> cat mkdir >> /dev/ttyp3=20
> 2) The group seems to be incorrect, a normal terminal has default group t=
ty
When using devpts, it looks good:
$ mesg
is y
$ ls -Al /dev/pts/0
crw--w---- 1 phi xxx 136, 0 Jul 14 11:25 /dev/pts/0
$ mesg n
$ ls -Al /dev/pts/0
crw------- 1 phi xxx 136, 0 Jul 14 11:26 /dev/pts/0
Cheers
Seb
--=20
/~\ The ASCII Sebastian Hans
\ / Ribbon Campaign hanss@in.tum.de
X Against HTML 0x5AED1E6D
/ \ Email! 014C 4A54 FED4 C0B5 3E87 427B 6910 AB0A 5AED 1E6D
--f2QGlHpHGjS2mn6Y
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA9QP3aRCrClrtHm0RAlb7AJ4qgRRS2n7Kw50RJ/E4WgE83WAekACfQw26
4DhqMTR6V/70Z8Vo+6RpnmQ=
=K6oI
-----END PGP SIGNATURE-----
--f2QGlHpHGjS2mn6Y--
