Re: Vunerability in HP sysdiag ?

[tsr () cave isdn cs tu-berlin de (Tobias Richter)]

> [rest of message deleted]
>
> I verified it for HP-UX 9.0X. Not only that, though. It is not sufficient
> to chmod u-s /bin/sysdiag. This leaves behind a bunch of programs in
> /usr/diag/bin which are still setuid to root and behave quite the same
> (i.e., they don't check for symlinks while creating 0666 log or temp
> files). A non-priviledged user can use any of these to create 0666
> /.rhosts (or whatever else) files, with the known consequences.

But also priviledged users create these 0666 files and will follow
bogus symlinks, too. You just have to create your symlink and wait
for root to do his regular work. Therefore this:

> Proposed solution:
> root# chmod u-s /bin/sysdiag /usr/diag/bin/*

is not enough. You will have to

root# chmod a-x /bin/sysdiag /usr/diag/bin/*

or get a patch quick.

tobias

--
======================================================================
Tobias Richter                         Try my Homepage: file:/dev/zero