OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1997: Re: digital unix 4.0 hole

Re: digital unix 4.0 hole

Johan Danielsson (jodaPDC.KTH.SE)
Sat, 15 Nov 1997 03:11:35 +0100 

John McDonald <jmcdonalOSPREY.UNF.EDU> writes:

> If you run dbx (tested on 3.11.10) on a setuid root program that you
> have read access to, the program will core dump and create a root
> owned 600 perm core in the current directory.

The problem isn't procfs per se, but rather that it causes the program
to dump core.

What happens in that in core(), vn_open() is called just before it's
supposed to `temporarily restore real user/group ids for file
operations'. For anyone with source, the fun happens around line 4350
in kernel/bsd/kern_sig.c.

If you're *real* paranoid about this, you might be able to:

# cp /vmunix /vmunix.save
# dbx /vmunix
dbx version 3.11.10
Type 'help' for help.

main:    Source not available

warning: Files compiled -g3: parameter values probably wrong
(dbx) ((unsigned*)core+82)/1 i
  [core:5261, 0xfffffc000026ff48]       and     r1, r2, r1
(dbx) patch *((unsigned*)core+82) = 0x203f0001
  [core:5261, 0xfffffc000026ff48]       lda     r1, 1(r31)
(dbx) q
# reboot

This might work with 4.0[ABC]; I haven't tried it though. :-) It
should completely disable all core dumps.

/Johan