From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Thu Aug 16 2007 - 07:53:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Dear Joey Mengele,

Of cause, it's mitigating factor. But:

default PATH_MAX under Linux is 4096, and it's not hard to create
file/folder with longer path, it's impossible to access it,

E.g. folder with path longer than PATH_MAX:

bash$ pwd
pwd: could not get current directory: getcwd: cannot access parent directories: Result too large
bash$ ls
job-working-directory: could not get current directory: getcwd: cannot access parent directories: Result too large

Access is not required in this case. It's possible to create
_searchable_ files with the length up to approximately MAX_PATH +
NAME_MAX. It's more than required to exploit (4128).

--Wednesday, August 15, 2007, 9:34:50 PM, you wrote to joey.mengelehushmail.com:

JM> You are playing handpuppet of the jackass, actually. Check PATH_MAX
JM> in the Linux Kernel.

JM> J

JM> On Wed, 15 Aug 2007 12:53:18 -0400 monikerd <monikerdgmail.com>
JM> wrote:
>>Joey Mengele wrote:
>>> Where does security come into play here? This is a local crash
>>in a
>>> non setuid binary. I would like to hear your remote exploitation
>>
>>> scenario. Or perhaps your local privilege escalation scenario?
>>>
>>> J
>>>
>>>
>>I'll play advocate of the devil then. Imagine a wiki running on a
>>webserver,
>>
>>that allows anybody to create new topics which end up in
>>/articles/[Topic].txt
>>with sufficient .htaccess stuff in /articles to twart most usual
>>attacks ..
>>
>>
>>If you could create an arbitrary long topic, then you *might*
>>be able to execute some code, when some cronjob would scan the
>>drive
>>and come across the file?
>>
>>creating files is a different privilege than running code. Hence
>>imho
>>it's not a bogus advisory.
>>
>>
>>another possibility would be to create an archive that extracts an
>>incredibly
>>long filename perhaps? scanning an archive before/after it's
>>extracted
>>is a pretty common event i guess.

JM> --
JM> Click for free information on accounting careers, $150 hour potential.
JM> http://tagline.hushmail.com/fc/Ioyw6h4dCaNyraR2kkZ8KcMCiTJDWZokEDbswig9iZ5cvsPFFYamWc/

JM> _______________________________________________
JM> Full-Disclosure - We believe in it.
JM> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
JM> Hosted and sponsored by Secunia - http://secunia.com/

--
~/ZARAZA http://securityvulns.com/
...áåç äóáèíêè íèêîãäà íå ïðèíèìàëñÿ îí çà ïðîãðàììèðîâàíèå. (Ëåì)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]