Bugtraq mailing list archives
Midnight Commander /tmp race
From: lcamtuf () BOSS STASZIC WAW PL (Michal Zalewski)
Date: Sun, 15 Mar 1998 16:33:47 +0100
Midnight Commander (I have version 4.1.8, RedHat 5.0) is launched using the following shell macro: mc=() { MC=/tmp/mc$$-"$RANDOM"; /usr/bin/mc -P "$@" >"$MC"; cd "`cat $MC`"; rm "$MC"; unset MC } Well, unfortunately it isn't secure. $$ is replaced with shell pid (not mc pid!!!) - usually it's user's login shell pid, and may be obtained with 'ps au|grep "\-bash"'. $RANDOM, as everyone knows, generates pseudo-random integer from range 0..32767. Well, 'random' number isn't very random, but even without mathematical tricks we can guess it - when we create eg. 1000 [sym]links (a few seconds), our chances are about 1/33, and probably target file will be sooner or later overwritten with mc's last working directory. With 10000 files (it will take maybe a half minute) - our chances incerases to about 1/3, but it needs more disk activity and may be detected... Solution? Use mktemp: MC=`mktemp mc$$-XXXXXX` instead of $RANDOM :))) _______________________________________________________________________ Michal Zalewski [tel 9690] | finger 4 PGP [lcamtuf () boss staszic waw pl] Iterowac jest rzecza ludzka, wykonywac rekursywnie - boska [P. Deustch] =--------------- [ echo "\$0&\$0">_;chmod +x _;./_ ] -----------------=
Current thread:
- Re: the purpose of dynamic memory allocation, (continued)
- Re: the purpose of dynamic memory allocation Jeffrey Hutzelman (Mar 10)
- Re: the purpose of dynamic memory allocation Alan Cox (Mar 11)
- DoS (and possibly more) on MDaemon for NT/95 Alvaro Martinez Echevarria (Mar 10)
- MDaemon SMTP Server Buffer Overflow's Aleph One (Mar 10)
- Security problem in Slackware. Suman_Saraf (Mar 11)
- Re: Security problem in Slackware. Peter van Dijk (Mar 13)
- /tmp event logger Michal Zalewski (Mar 14)
- Re: /tmp event logger Theo de Raadt (Mar 15)
- Vunerable shell scripts Michal Zalewski (Mar 14)
- More broadcast fun T. Freak (Mar 14)
- Midnight Commander /tmp race Michal Zalewski (Mar 15)
- Re: Midnight Commander /tmp race Pavel Kankovsky (Mar 17)
- Re: Midnight Commander /tmp race willy () SNOWYOWL CSU AC RU (Mar 17)
- Re: Midnight Commander /tmp race Pavel Kankovsky (Mar 18)
- Solaris printd security vulnerability Aleph One (Mar 11)
- Sun Security Bulletin #00165 Aleph One (Mar 11)
- Fwd: Sun Security Bulletin #00166 Tony Hagale (Mar 11)
- SLMail 2.6 DoS Steven (Mar 11)
- SLMail 2.6 DoS - Imail also Jon (Mar 11)
- Winsock 2.0 DoS John Robinson (Mar 11)
- Re: Winsock 2.0 DoS Henri Karrenbeld (Mar 12)