OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: BRU Vulnerability
From: Jeremy Rauch (jrauchSECURITYFOCUS.COM)
Date: Thu Jun 08 2000 - 16:05:26 CDT

On Thu, Jun 08, 2000 at 09:28:48AM +0300, Gavrie Philipson wrote:
> root wrote:
> > BRU backup software Vulnerability:
> >
> > Description:
> > You can change the log file BRU uses by changing the
> > BRUEXECLOG environment variable. Since bru is setuid
> > root you can append to any file on the system.
>
> Why, am I wondering, would a sane person install BRU with setuid
> permissions?
> That's like installing tar with setuid permissions and wondering about
> overwritten files.
>
> On my systems, BRU words fine without any setuid/setgid perms.

By default, BRU is installed setuid root. If it isn't, and is run by a
non-root user, it complains:
bru: [W171] warning - BRU must be owned by root and have suid bit set

Many (most) users who install BRU probably never think to check if its
installed setuid. Should it be? Probably not, but it is a very real
vulnerability under a default install.
-j