Bugtraq mailing list archives

By Date

By Thread

Re: load.root (loadmodule hole)

From owner-bugtraq () CRIMELAB COM  Fri Sep 15 15:46:48 1995
Am I overlooking something obvious here, or would simply turning off the
set-UID bit on "loadmodule" be an acceptable temporary workaround for
most sites?
-----
Fred Blonder            fred () nasirc hq nasa gov

Hughes STX Corp.        (301) 441-4079
7701 Greenbelt Rd.
Greenbelt, Md.  20770

turning of the suid bit works *mostly*

 of course don't expect to be able to run openwindows :-)

I say mostly because there is still the problem if the process running
is running as root, as well as the problem of if another
setuid executable calls loadmodule.

Neither of these is as big a problem, but they are still there.

Calling system() has never been a smart thing, just a simple thing.

Brad
=======================================================================
Brad Powell : brad.powell () Sun COM
Sr. Network Security Consultant
SunNetworks, Sun Microsystems Inc.
=======================================================================
               The views expressed are those of the author and may
                  not reflect the views of Sun Microsystems Inc.
=======================================================================

By Date

By Thread

Current thread:

• load.root (loadmodule hole) der Mouse (Sep 15)
  • Re: load.root (loadmodule hole) Urban (Sep 15)
    • Re: load.root (loadmodule hole) Fred Blonder (Sep 15)
      • Re: load.root (loadmodule hole) Pat The Friendly RedNeck (Sep 15)
    • Re: load.root (loadmodule hole) Urban (Sep 18)
    • INN1.4sec on Linux Olaf Kirch (Sep 18)
      • Re: INN1.4sec on Linux Dave Barr (Sep 25)
  • <Possible follow-ups>
  • Re: load.root (loadmodule hole) Brad Powell (Sep 15)
    • Re: load.root (loadmodule hole) Karl Strickland (Sep 17)
    • Re: load.root (loadmodule hole) Casper Dik (Sep 26)
  • Re: load.root (loadmodule hole) Brad Powell (Sep 16)
  • Re: load.root (loadmodule hole) Dave Mitchell (Sep 18)