Re: d_path() truncating excessive long path name vulnerability

From: Paul Szabo (pszat_private)
Date: Tue Nov 26 2002 - 18:04:04 PST

Previous message: Arne Vidstrom: "Kerberos login sniffer and cracker for Windows 2000/XP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Back in March 2002, Wojciech Purczynski <cliphat_private> wrote (original
article at http://online.securityfocus.com/archive/1/264117 ):

> Name:		Linux kernel
> Version:	up to 2.2.20 and 2.4.18
> ...
> In case of excessively long path names d_path kernel internal function
> returns truncated trailing components of a path name instead of an error
> value. As this function is called by getcwd(2) system call and
> do_proc_readlink() function, false information may be returned to
> user-space processes.

The problem is still present in Debian 2.4.19 kernel. I have not tried 2.5,
but see nothing relevant in the Changelogs at http://www.kernel.org/ .

Cheers,

Paul Szabo - pszat_private  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia

Next message: Dave B.: "AIM Bug"
Previous message: Arne Vidstrom: "Kerberos login sniffer and cracker for Windows 2000/XP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Nov 30 2002 - 12:03:04 PST