Bugtraq mailing list archives
Re: Unprivilegued settings for FreeBSD kernel variables
From: "blexim" <blexim () hush com>
Date: Fri, 18 Jun 2004 10:40:59 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I've already told you that there is no such threat, since the attack you describe can only be initiated by someone who already has unrestricted access. Please stop wasting everybody's time.You are wrong. Unrestricted access means _really unrestricted_ and kernel securelevel restricts access to certain places even to root. IMHO, it's dagerous bug, because some administrators can think "...hmm,
I've enabled the hardest securelevel and even if a hacker would break into my host with r00t privileges he will be restricted in certain ways. The only thing he can do is to change /etc/rc.conf (for example) and _reboot_ my host. But I will notice the reboot." So, for certain people the following formulae may hold: Hardest securelevel + no reboots = good security. But this bug changes things. One can lower securelevel, do some nasty
things
and raise it again _without reboots_. So, as I've already noted, you
are wrong.
The bug _gives_ you almost unrestricted access.
You can't load the LKM unless securelevel <= 0. Therefore, if securelevel
0 (the default securelevel for multi-user operation is 1) you can't
load your evil LKM & thus can't lower the securelevel. Essentially this means that if the securelevel is 0 or lower, you can lower it even further, but if this is the case there are no protections effected by securelevel anyway. In other words, there is absolutely no threat presented by the attack you describe. blexim -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkDTKTMACgkQsE7ilXLZoGa3vwCdEM0+r9e9OMBvXs8HXIsVyIsCzDgA n2CffOjRHyMfT3WdLCY9opAV9qdK =uDmH -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about.php?subloc=affiliate&l=427
Current thread:
- Re: Unprivilegued settings for FreeBSD kernel variables, (continued)
- Re: Unprivilegued settings for FreeBSD kernel variables Dag-Erling Smørgrav (Jun 16)
- Re: Unprivilegued settings for FreeBSD kernel variables Eygene A. Ryabinkin (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Jason V. Miller (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Christian Ullrich (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Ivaylo Kostadinov (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Eygene A. Ryabinkin (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Manuel Bouyer (Jun 18)
- Re: Unprivilegued settings for FreeBSD kernel variables Valdis . Kletnieks (Jun 19)
- Re: Unprivilegued settings for FreeBSD kernel variables Wietse Venema (Jun 22)
- Re: Unprivilegued settings for FreeBSD kernel variables Henning Brauer (Jun 19)
- Re: Unprivilegued settings for FreeBSD kernel variables Valdis . Kletnieks (Jun 19)
- Re: Unprivilegued settings for FreeBSD kernel variables Jason V. Miller (Jun 21)
- Re: Unprivilegued settings for FreeBSD kernel variables blexim (Jun 20)
- Re: Unprivilegued settings for FreeBSD kernel variables Dag-Erling Smørgrav (Jun 16)