[972] in bugtraq
Re: SUID shell scripts, questions?
daemon@ATHENA.MIT.EDU (Carson Gaspar)
Sat Feb 11 19:45:39 1995
Date: Sat, 11 Feb 1995 18:38:00 -0500 (EST)
From: Carson Gaspar <carson@lehman.com>
To: Greg Woods <woods@ncar.ucar.edu>
Cc: "That Whispering Wolf..." <elfchief@lupine.org>, bugtraq@fc.net
In-Reply-To: <199502110023.RAA15201@ncar.ucar.EDU>
On Fri, 10 Feb 1995, Greg Woods wrote:
> Or you can just create a symlink to a setuid script called "-i". Guess
> what happens when the system executes "sh -i"? Don't even need the
> race condition. And even without this, you could always overwrite the
> SAME file with something new, so the fd doesn't change.
Attack #1 (symlink -i) fails under solaris. The shell is invoked as:
/bin/sh /dev/fd/xxx
Attack #2 is only possible if you're dumb enough to leave a setuid
program world-writeable.
--
Carson Gaspar -- carson@cs.columbia.edu carson@lehman.com
<This is the boring business .sig - no outre sayings here>
