Re: [Re: Amanda multiple vendor local root compromises]

[btellier () USA NET (Brock Tellier)]

vectro () pipeline com wrote:

> This is almost true. This exploit can only be performed as the user >amanda
> is installed under (generally amanda, operator, or bin), because by
> default the file has the following permissions:
> $ ls -l /usr/local/libexec/runtar
> -rwsr-x---   1 root     amanda      46568 Oct 26 00:21
> /usr/local/libexec/runtar

> If your amanda is properly installed, then it is as a user amanda, bin, >or
operator, none of which should be accessible from a regular user. If >this
account is compromised, then security is irrelevant because amanda >need to be
able to read the raw disk files (to do backups) and thus would >be able to get
/etc/shadow (or the local equivalent) without much work.

On my system (FreeBSD 3.3-RELEASE + amanda-2.4.1 package included on CD):

-rwsr-xr-x root/wheel

And thus ANY user, not just amanda/bin/operator can exploit runtar. 
Obviously, from the replies I've recieved, this is an error in the package
installation, but I assure you that it was entierly automated by
/stand/sysinstall and not fooled with by me.

"Properly installed" is an interesting phrase.  If by "properly" you mean "not
mucking around with the default permissions", than I did exactly that.  My
installation of FreeBSD 3.3-RELEASE was about 3 days old and I had just
installed the Amanda-2.4.1 package before starting my testing.  Perhaps it is
reasonable for everyone to check the permissions of every suid program (I
certianly do), but, of course, this doesn't always happen. In any case, I
don't *think* this is an installation error on my part and I will try
installing again to see if I come up with the same permissions.  One
interesting point is that some of amanda's other suid programs such as
"killprg" and "rundump" have the correct rwsr-x--- root/operator permissions
on my system.  I would like some Bugtraq subscribers to try and install this
package on the same configuration I have and see what they get.  

Brock Tellier
UNIX Systems Administrator
Chicago, IL 

____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1