OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: snsadvlac.co.jp
Date: Thu Jul 19 2001 - 00:18:44 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----------------------------------------------------------------------
    SNS Advisory No.37
    HTTProtect allows attackers to change the protected file using a symlink

    Problem first discovered: Mon, 4 Jun 2001
    Published: Wed, 18 Jul 2001
    ----------------------------------------------------------------------

    Overview
    ---------
    HTTProtect is a security product released by Omnisecure
    (http://www.ominisecure.com) which prevents users from changing
    and deleting file on the ext2 file system.

    Even if attackers gain root privilege, it prevents them from
    changing or deleting protected files.
    But there is a problem which attackers can change protected files
    bypassing the access-control.

    Problem Description
    -------------------
    Even if attackers have the root privilege, protected files cannot
    be changed, but they can change protected files under these conditions:

    1.Attackers can make symlink in a writable directory(ex. /tmp)
    2.They are the owner of the target file or they have root privilege.

    example: (A protected file is /opt/www/html/index.html)
      $ ln -s /opt/www/html/index.html /tmp/foo
      $ vi /tmp/foo (cat /tmp/hack.html > /tmp/foo)

    Tested Version
    --------------
    HTTProtect 1.1.1

    Tested on
    ---------
    RedHatLinux 6.2-J(Kernel 2.2.14-50)

    Status of fixes
    ---------------
    Patch is available on Omnisecure Web site now.
    http://www.omnisecure.com/products/http/Linux/1.1.1/index.htm\27$B!K\27(B

    Discovered by
    -------------
     (TANIDA Fusao / LAC) tanidalac.co.jp

    Disclaimer
    ----------
      All information in these advisories are subject to change without any
      advanced notices neither mutual consensus, and each of them is
      released as it is. LAC Co.,Ltd. is not responsible for any risks of
      occurrences caused by applying those information.

    References
    ----------
      Archive of this advisory:
      http://www.lac.co.jp/security/english/snsadv_e/37_e.html

    ------------------------------------------------------------------
    Secure Net Service(SNS) Security Advisory <snsadvlac.co.jp>
    Computer Security Laboratory, LAC http://www.lac.co.jp/security/