Bugtraq mailing list archives
Re: Samba 3.x + kernel 2.6.x local root vulnerability
From: Felipe Franciosi <ozzybugt () terra com br>
Date: Mon, 09 Feb 2004 22:07:46 -0200
This is old news. NFS is also affected by this CONFIGURATION PROBLEM (not a bug). What I think might be a problem is this: [...took_from_mount_man...] OPTIONS [...] nosuid Do not allow set-user-identifier or set-group-identifier bits to take effect. (This seems safe, but is in fact rather unsafe if you have suidperl(1) installed.) [...end_of_cut...] I have never tried to use suidperl to "exploit" such thing, but my guess is that suidperl somehow "see" the suid bit and can execute scripts set- uid-ing the process... or maybe the man mount page was just talking about some old suidperl bug... if someone knows, please tell me. Best Regards, Felipe -- Felipe Franciosi <ozzybugt () terra com br>
Current thread:
- Samba 3.x + kernel 2.6.x local root vulnerability Michal Medvecky (Feb 09)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Michael Kjorling (Feb 09)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Seth Arnold (Feb 09)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Patrick J. Volkerding (Feb 09)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Frank Louwers (Feb 11)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Urban Widmark (Feb 12)
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Darren Reed (Feb 13)
- Message not available
- Message not available
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Guille -bisho- (Feb 10)
- Message not available
- Re: Samba 3.x + kernel 2.6.x local root vulnerability Felipe Franciosi (Feb 11)
- <Possible follow-ups>
- RE: Samba 3.x + kernel 2.6.x local root vulnerability John . Airey (Feb 11)