[9670] in bugtraq
Re: snap utility for AIX.
daemon@ATHENA.MIT.EDU (Brian Hauber)
Fri Feb 19 19:11:20 1999
Date: Thu, 18 Feb 1999 14:25:57 -0600
Reply-To: Brian Hauber <hauber@AUSTIN.IBM.COM>
From: Brian Hauber <hauber@AUSTIN.IBM.COM>
X-To: "Larry W. Cashdollar" <lwcashd@trout.biw.com>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <199902171517.KAA03535@trout.Biw.COM>; from Larry W. Cashdollar
on Wed, Feb 17, 1999 at 10:17:08AM -0500
On Wed, Feb 17, 1999 at 10:17:08AM -0500, Larry W. Cashdollar wrote:
> My friend actually brought this to my attention, the snap command is a
> diagnostic utlitiy for gathering system information on AIX platforms.
> It can only be executed by root, but it copies various system files into
> /tmp/ibmsupt/
> under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext.
> The danger here is if a system administrator executes snap -a as sometimes
> requested by IBM support while diagnosing a problem it defeats password
> shadowing. I would think that snap would create the directory 700
> root:root.
Yes, /tmp/ibmsupt is created with 755 permissions however what you
neglected to check was the permissions on /tmp/ibmsupt/general/passwd
I took the liberty of running 'snap -a' on our systems here at varying
levels and here are the results:
-------------------------------------------------------------------------------
3.2.5.1 with 3.2.5.1-02 Maintenance Level
# ls -ld /tmp/ibmsupt
drwxr-xr-x 17 root system 512 Feb 18 02:08 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root security 1585 Feb 9 05:45 /tmp/ibmsupt/general/passwd
-------------------------------------------------------------------------------
4.1.5 BASE
# ls -ld /tmp/ibmsupt
drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd
-------------------------------------------------------------------------------
4.1.5 with 4.1.5-01 Maintenance Level
# ls -ld /tmp/ibmsupt
drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root system 2183 Feb 18 10:09 /tmp/ibmsupt/general/passwd
--------------------------------------------------------------------------------
4.2.1 BASE
# ls -ld /tmp/ibmsupt
drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd
--------------------------------------------------------------------------------
4.2.1 with 4.2.1-03 Maintenance Level
# ls -ld /tmp/ibmsupt
drwxr-xr-x 15 root system 512 Feb 18 14:05 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root security 645 Feb 15 15:22 /tmp/ibmsupt/general/passwd
--------------------------------------------------------------------------------
4.3.1 BASE
# ls -ld /tmp/ibmsupt
drwxr-xr-x 18 root system 512 Feb 18 12:03 /tmp/ibmsupt/
HOWEVER
# ls -ld /tmp/ibmsupt/general/passwd
-rw------- 1 root security 1210 Feb 18 10:55 /tmp/ibmsupt/general/passwd
--------------------------------------------------------------------------------
4.3.2 BASE
# ls -ld /tmp/ibmsupt
drwx------ 18 root system 512 Feb 18 14:02 /tmp/ibmsupt/
--------------------------------------------------------------------------------
This "problem" seems to have been fixed at 4.3.2.
--
Brian Hauber | AIX Support Line | E-mail: hauber@austin.ibm.com
