[6517] in bugtraq
Re: obsd boot hack (boot-modified-kernel-attack)
daemon@ATHENA.MIT.EDU (Juergen Schmidt)
Tue Apr 14 13:35:26 1998
Date: Tue, 14 Apr 1998 16:36:19 +0200
Reply-To: Juergen Schmidt <ju@ct.heise.de>
From: Juergen Schmidt <ju@CT.HEISE.DE>
X-To: shipley@DIS.ORG
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <199804140947.CAA25451@merde.dis.org>
> Linux systems using LILO to boot are not vulnerable although Sparc
> Linux with SILO is vulnerable to a similar "boot-modified-kernel-attack"
> unless they are utilize a boot a password in the /etc/silo.conf
> configuration file.
> (thanks to Jon Paul Nollmann <sinster@darkwater.com> for Linux Q & A)
While it is true that Linux/LILO is not vulnerable to this specific attack, it
should be noted, that gaining root on a Linux box via LILO boot-prompt is even
easier: you don't even need a modified kernel. Giving an init=/bin/sh as boot
parameter invokes the shell instead of init. After executing the necessary
init-scripts manually, you have full root-access to the machine.
To avoid this, you should add "RESTRICTED" and set a password in your
lilo.conf, which is then required to set any boot-options (don't forget, to
make /etc/lilo.conf read-only for root, it contains the password in clear text)
bye, juergen
Juergen Schmidt Redakteur/editor c't magazin
Verlag Heinz Heise GmbH & Co KG, Helstorferstr. 7, D-30625 Hannover
EMail: ju@ct.heise.de - Tel.: +49 511 5352 300 - FAX: +49 511 5352 417
