vectroat_private wrote: >This is almost true. This exploit can only be performed as the user >amanda >is installed under (generally amanda, operator, or bin), because by >default the file has the following permissions: >$ ls -l /usr/local/libexec/runtar >-rwsr-x--- 1 root amanda 46568 Oct 26 00:21 >/usr/local/libexec/runtar >If your amanda is properly installed, then it is as a user amanda, bin, >or operator, none of which should be accessible from a regular user. If >this account is compromised, then security is irrelevant because amanda >need to be able to read the raw disk files (to do backups) and thus would >be able to get /etc/shadow (or the local equivalent) without much work. On my system (FreeBSD 3.3-RELEASE + amanda-2.4.1 package included on CD): -rwsr-xr-x root/wheel And thus ANY user, not just amanda/bin/operator can exploit runtar. Obviously, from the replies I've recieved, this is an error in the package installation, but I assure you that it was entierly automated by /stand/sysinstall and not fooled with by me. "Properly installed" is an interesting phrase. If by "properly" you mean "not mucking around with the default permissions", than I did exactly that. My installation of FreeBSD 3.3-RELEASE was about 3 days old and I had just installed the Amanda-2.4.1 package before starting my testing. Perhaps it is reasonable for everyone to check the permissions of every suid program (I certianly do), but, of course, this doesn't always happen. In any case, I don't *think* this is an installation error on my part and I will try installing again to see if I come up with the same permissions. One interesting point is that some of amanda's other suid programs such as "killprg" and "rundump" have the correct rwsr-x--- root/operator permissions on my system. I would like some Bugtraq subscribers to try and install this package on the same configuration I have and see what they get. Brock Tellier UNIX Systems Administrator Chicago, IL ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:09:21 PDT