[SNS Advisory No.37] HTTProtect allows attackers to change the protected file using a symlink

["snsadv () lac co jp" <snsadv () lac co jp>]

-----------------------------------------------------------------------
SNS Advisory No.37
HTTProtect allows attackers to change the protected file using a symlink

Problem first discovered: Mon, 4 Jun 2001
Published: Wed, 18 Jul 2001
----------------------------------------------------------------------

Overview
---------
HTTProtect is a security product released by Omnisecure
(http://www.ominisecure.com) which prevents users from changing
and deleting file on the ext2 file system.

Even if attackers gain root privilege, it prevents them from
changing or deleting protected files.
But there is a problem which attackers can change protected files
bypassing the access-control.

Problem Description
-------------------
Even if attackers have the root privilege, protected files cannot
be changed, but they can change protected files under these conditions:

1.Attackers can make symlink in a writable directory(ex. /tmp)
2.They are the owner of the target file or they have root privilege.

example: (A protected file is /opt/www/html/index.html)
  $ ln -s /opt/www/html/index.html /tmp/foo
  $ vi /tmp/foo (cat /tmp/hack.html > /tmp/foo)

Tested Version
--------------
HTTProtect 1.1.1

Tested on
---------
RedHatLinux 6.2-J(Kernel 2.2.14-50)

Status of fixes
---------------
Patch is available on Omnisecure Web site now.
（http://www.omnisecure.com/products/http/Linux/1.1.1/index.htm）

Discovered by
-------------
 (TANIDA Fusao / LAC)　tanida () lac co jp

Disclaimer
----------
  All information in these advisories are subject to change without any 
  advanced notices neither mutual consensus, and each of them is
  released as it is. LAC Co.,Ltd. is not responsible for any risks of
  occurrences caused by applying those information.

References
----------
  Archive of this advisory:
  http://www.lac.co.jp/security/english/snsadv_e/37_e.html

------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv () lac co jp>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/