Linux-kernel mailing list archive 1998-31,: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

# Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Alan Cox (alan@lxorguk.ukuu.org.uk)
Tue, 4 Aug 1998 22:23:36 +0100 (BST)

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Linus Torvalds: "Re: profile patch for 2.1.114"
- Previous message: Kit Cosper: "2.0.35 on Alpha - floppy strangeness"
- Next in thread: Linus Torvalds: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Linus Torvalds: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Edward S. Marshall: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"

> So what do you do when somebody comes up with a crack that instead of
> writing code to the stack just modifies the return address to point to
> some known point in the shared library code or something like that?

Its actually very hard to get anything beyond a denial of service attack
via libc vectors. Its doable

> Then posts it on the cracker lists, and suddenly your precious patch does
> nothing at all for you?

Download the contents of www.rootshell.com - try then against generic
slackware, debian 1.x or redhat 5.0. Add the stack patch and try again

There is _one_ local only exploit available from whats basically "computer
demolition by numbers" and that was written by someone who took great
pride in having achieved it.

> The reason I don't like the patch is that it's a classic example of
> security by obscurity. It's the Windows NT approach to security, and the
> fact that Solaris does it too does not impress me in the least.

It impresses their customer base a lot. I wouldn't consider running
a Linux based firewall without it, and I would suggest any one else planning
to use a Linux box as a firewall or exposed web server etc thinks about
using it.

Things like non executable stack are the equivalent of fitting decent
home security - they deter attacks, they stop the amateurs but if a team
of ex US navy seals decide to burgle your house - you lose.

If you wander out of beyond the transmeta firewall into ISPland Linus you'll
find its basically all out warfare right now. www.linux.org.uk before it
was behind a ton of firewalls used to record just over 150 suspicious probes
or connections a day. Since it happened to be a Linux/m68k box I didnt have
to worry too much 8)

I'm just waiting until they crackers get a good grip on BGP4 8)

Alan

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Linus Torvalds: "Re: profile patch for 2.1.114"
- Previous message: Kit Cosper: "2.0.35 on Alpha - floppy strangeness"
- Next in thread: Linus Torvalds: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Linus Torvalds: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Reply: Edward S. Marshall: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"