Re: Solaris 2.x chkperm/arp vulnerabilities

From: Craig Ruefenacht (ruefenacat_private)
Date: Mon Dec 06 1999 - 11:07:02 PST

  • Next message: Pauli Ojanpera: "Local user can fool another to run executable. .CNT/.GID/.HLP"

    This is a cryptographically signed message in MIME format.
    
    --------------ms755F4D7D15266979D5337A2A
    Content-Type: text/plain; charset=us-ascii
    Content-Transfer-Encoding: 7bit
    
    Hi,
    
    I verified that this bug exists in Solaris 2.7 with the latest security
    and recommended patches too.
    
    > Arp bug Verified for my Solaris 5.6 and 5.5.1 Installs.
    >
    > $ uname -a
    > SunOS pangea 5.5.1 Generic_103640-26 sun4u sparc SUNW,Ultra-5_10
    >
    >
    > # uname -a
    > SunOS vapid 5.6 Generic_105181-05 sun4u sparc SUNW,Ultra-5_10
    > #
    >
    > $ ls -l /etc/bin
    > -rw-rw----   1 bin      bin           23 Dec  1 13:54 /etc/bin
    >
    > On both machines I could read bin:bin owned files as a regular joe user with arp
    
    
    --
    -------------------------------------------------------------
    Craig Ruefenacht                             Systems Engineer
    ruefenacat_private              Digital Signature Trust
    (801) 983-4401                    http://www.digsigtrust.com/
    -------------------------------------------------------------
    --------------ms755F4D7D15266979D5337A2A
    Content-Type: application/x-pkcs7-signature; name="smime.p7s"
    Content-Transfer-Encoding: base64
    Content-Disposition: attachment; filename="smime.p7s"
    Content-Description: S/MIME Cryptographic Signature
    
    MIIH2AYJKoZIhvcNAQcCoIIHyTCCB8UCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC
    BYYwggWCMIIEaqADAgECAhEA0B5AiwAAAnwAAAASAAACxTANBgkqhkiG9w0BAQUFADCBqTEL
    MAkGA1UEBhMCdXMxDTALBgNVBAgTBFV0YWgxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MSQw
    IgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xETAPBgNVBAsTCERTVENBIFgx
    MRYwFAYDVQQDEw1EU1QgUm9vdENBIFgxMSEwHwYJKoZIhvcNAQkBFhJjYUBkaWdzaWd0cnVz
    dC5jb20wHhcNOTkwOTI0MTczMjQ5WhcNOTkxMjIzMTczMjQ5WjCCAQoxCzAJBgNVBAYTAlVT
    MQ0wCwYDVQQIEwRVdGFoMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEkMCIGA1UEChMbRGln
    aXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMUIwQAYDVQQLEzlXYXJuaW5nOiBUZXN0IHVzZSBv
    bmx5IFJlbGlhbmNlIExpbWl0IDAgRG9sbGFyIFZhbHVlIFV0YWgxGzAZBgNVBAMTEkNyYWln
    IFIgUnVlZmVuYWNodDEnMCUGCSqGSIb3DQEJARYYcnVlZmVuYWNAZGlnc2lndHJ1c3QuY29t
    MSMwIQYKCZImiZPyLGQBARMTRDAxRTQwOEIuMjdDLjEyLjJDMzCBnzANBgkqhkiG9w0BAQEF
    AAOBjQAwgYkCgYEAzxfoUPGI3RkvAEF+zc47ayYT0SpWcaIsoQg0WvFyA3O5JFR4F9Oarbaa
    Cp05O+pfQH88iFirsiM9fv/zbWZx8lphrvaHSfSBdEg07P4+xsAmZWWZzoVpgodR0gJzk4zg
    P2YUGa4b0/fbHiBIlQUqokfzVoX6dJNjGFt0bxD9IY0CAwEAAaOCAcMwggG/MHIGA1UdHwRr
    MGkwZ6BloGOGYWxkYXA6Ly9ib3NjaC5kaWdzaWd0cnVzdC5jb206L291PURTVENBIFgxLG89
    RGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Qw
    ggEsBglghkgBhvhCAQ0EggEdFoIBGVRoZSB2YWx1ZSBvZiB0aGlzIFRydXN0IElEIENlcnRp
    ZmljYXRlLCBpdHMgcmVsaWFuY2UgbGltaXQsIGFuZCB0aGUgbGlhYmlsaXR5IG9mIHRoZSBp
    c3N1ZXIgYXJlIGVzdGFibGlzaGVkIGJ5IGNvbnRyYWN0IGFuZCBsaW1pdGVkIGJ5IHV0YWgg
    bGF3LiAgVG8gcmVhc29uYWJseSByZWx5IG9uIHRoaXMgY2VydGlmaWNhdGUsIHlvdSBtdXN0
    IGJlIGFuIGF1dGhvcml6ZWQgcmVseWluZyBwYXJ0eSBhbmQgdmFsaWRhdGUgaXQgYXQ6ICBo
    dHRwczovL3NlY3VyZS5kaWdzaWd0cnVzdC5jb20vdHMuMAwGA1UdEwQFMAMBAQAwCwYDVR0P
    BAQDAgP4MA0GCSqGSIb3DQEBBQUAA4IBAQB2nn7uFWlMtFuNOpfOznxE4dA79Wjt9T2gqkyk
    Hsqabe2bDVTZ0VicfwNVheI4tFzJvBOXP7APNZTOOFHG/Khv8CDifQpf/un7LnrJtAF5wOF6
    QFCfl0EegLfr/W9sSlGdZ63ukjZO10/W9V4JTdZ6/Oc+ND9td/H+EbqJy2u4o45SWR2aiY7E
    NVBXJjCdP6cKiu+Cw5Yk19CzlEoTdZUR7fRXbC9vu55mTBGnH/IGF6/aVpEIQ/dcMoRGd8r1
    MxLUVMps+MU+ITrKUShplHXGLY6ZZTDgKtceFCvmTPfFYCPjPGSiuzePkEFXU9GG5qpg/gCE
    DBygp36JkkHyujZCMYICGjCCAhYCAQEwgb8wgakxCzAJBgNVBAYTAnVzMQ0wCwYDVQQIEwRV
    dGFoMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1
    cmUgVHJ1c3QgQ28uMREwDwYDVQQLEwhEU1RDQSBYMTEWMBQGA1UEAxMNRFNUIFJvb3RDQSBY
    MTEhMB8GCSqGSIb3DQEJARYSY2FAZGlnc2lndHJ1c3QuY29tAhEA0B5AiwAAAnwAAAASAAAC
    xTAJBgUrDgMCGgUAoIGxMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkF
    MQ8XDTk5MTIwNjE5MDcwMlowIwYJKoZIhvcNAQkEMRYEFDkfLzrWfX7+0CDZldP3IvSbEkKl
    MFIGCSqGSIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIH
    MA0GCCqGSIb3DQMCAgFAMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIGAqPoGT/o9
    4h5A5xEhwuI/ZethGMXeFvm1AgnasnhihROxxQ1iBNGKfV5m4y0LoHkHS2/ew+DtOHp/TrvL
    Qr82DlFzGBpDjmDk118IhT7DylnxkaB8FN6RF0xp1d254CPqK+Z4YRXM3KU9vq/FHKzJFhBj
    cDGITSGmDeUPCKpXCrE=
    --------------ms755F4D7D15266979D5337A2A--
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:17:42 PDT