Vulnerability in ccdconfig

From: Niall Smart (rotelat_private)
Date: Tue Dec 30 1997 - 18:02:31 PST

  • Next message: Warner Losh: "Re: Vulnerability in ccdconfig" 

    Hi,

FreeBSD and NetBSD's ccdconfig doesn't do proper checking of the
argument to -f:

[nsmart@ginseng ~]$ ccdconfig -U -f /dev/mem 2>&1 | strings | grep Charlie
root:iDeLeTeDiT:0:0::0:0:Charlie: No such file or directory
^C

I had to cat /etc/master.passwd in another window to get this to
work though :) So perhaps its not very easily exploitable, but
is worth fixing nonetheless.

This bug was also spotted by olivierat_private and fixed in OpenBSD
some time ago.

Fixes:

 * FreeBSD and NetBSD have been notified of the problem and have fixed
   it in their source tree's as of yesterday  (FreeBSD-current,
   FreeBSD-stable, NetBSD-current)  Retrieve the patched ccdconfig.c
   and compile yourself a new ccdconfig.

 * "chmod g-s /sbin/ccdconfig". I can't think of any reason for it to be
   sgid kmem.


Regards,

Niall

    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:37:59 PDT