[33619] in bugtraq
Re: Samba 3.x + kernel 2.6.x local root vulnerability
daemon@ATHENA.MIT.EDU (Felipe Franciosi)
Wed Feb 11 15:41:30 2004
Date: Mon, 09 Feb 2004 22:07:46 -0200
From: Felipe Franciosi <ozzybugt@terra.com.br>
To: Michal Medvecky <M.Medvecky@sh.cvut.cz>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20040209212303.GD18775@slovakia.sh.cvut.cz>
Message-Id: <20040209220312.52E0.OZZYBUGT@terra.com.br>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
This is old news.
NFS is also affected by this CONFIGURATION PROBLEM (not a bug). What I
think might be a problem is this:
[...took_from_mount_man...]
OPTIONS
[...]
nosuid Do not allow set-user-identifier or set-group-identifier
bits to take effect. (This seems safe, but is in fact
rather unsafe if you have suidperl(1) installed.)
[...end_of_cut...]
I have never tried to use suidperl to "exploit" such thing, but my guess
is that suidperl somehow "see" the suid bit and can execute scripts set-
uid-ing the process... or maybe the man mount page was just talking
about some old suidperl bug... if someone knows, please tell me.
Best Regards,
Felipe
--
Felipe Franciosi <ozzybugt@terra.com.br>
