Re: Suspicious files in /tmp

["Remko Lodder" <remko () elvandar org>]

Hello Matt,

Indeed FreeBSD doesn't respect the cases where a shell script is on a
noexec mounted device; but where /bin/sh is still executable (/bin/sh
/tmp/script for example). From the Manual page this should be clear that
it is not designed as a security measure but to aid other activities; it
is unlikely that we (see the archives for more information, this had been
discussed a couple of times) will change this behaviour (since the design
isn't for
security):

mount(8):

             noexec  Do not allow execution of any binaries on the mounted
                     file system.  This option is useful for a server that
has
                     file systems containing binaries for architectures other
                     than its own.  Note: This option was not designed as a
                     security feature and no guarantee is made that it will
                     prevent malicious code execution; for example, it is
                     still possible to execute scripts which reside on a
                     noexec mounted partition.


Hope this helps aiding you a bit with the information we can deliver.

Regards,
Remko

On Mon, June 18, 2007 6:47 pm, Matt D. Harris wrote:
> They're being executed despite filesystem mount options because the
> script isn't being executed, the perl interpretter is.  The script is
> being read and interpretted by the perl interpretter.  Interesting - I
> hadn't thought of this before.  Some logic to check the underlying
> filesystem of a script before reading it would be a very cool addition
> to perl from a security standpoint.  Wouldn't be a big performance hit
> at all just to check once every require, etc as well.  It'd need to be
> somewhat platform specific.  Anyways, it would be neat for someone to
> bring this up within the Perl community as a possible idea, and maybe
> consider python, ruby, and others as well.  Then there're various
> shells... I tested bash and FreeBSD's /bin/sh, and neither of them
> respect the noexec mount flag on FreeBSD either.  It seems like this
> should be a relatively easy problem to correct, at least for the most
> common platforms.  It's a thought that I'm going to bring up with the
> FreeBSD guys and see what their reaction is.  Thanks for bringing this
> up here.  Take care, Matt
>
> kladizkov.thehome wrote:
> > Hi,
> >
> > My firewall LFD, pulled out three perl scripts from /tmp. It was found
> > to be executing in my server. I have attached the scripts along with
> > this mail. Is this issue familiar to anyone?
> >
> > How can a script uploaded to /tmp be executed when it has noexec
> > privilege?
> >
> >
> > ------------------------------------------------------------------------
> >
> > -------------------------------------------------------------------------
> > This list sponsored by: SPI Dynamics
> >
> > ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper
> > It's as simple as placing additional SQL commands into a Web Form input
> > box
> > giving hackers complete access to all your backend systems! Firewalls
> > and IDS
> > will not stop such attacks because SQL Injections are NOT seen as
> > intruders.
> > Download this *FREE* white paper from SPI Dynamics for a complete guide
> > to protection!
> >
> > https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
> > --------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This list sponsored by: SPI Dynamics
>
> ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper
> It's as simple as placing additional SQL commands into a Web Form input
> box
> giving hackers complete access to all your backend systems! Firewalls and
> IDS
> will not stop such attacks because SQL Injections are NOT seen as
> intruders.
> Download this *FREE* white paper from SPI Dynamics for a complete guide to
> protection!
>
> https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
> --------------------------------------------------------------------------


-- 
Kind regards,

     Remko Lodder               ** remko () elvandar org
     FreeBSD                    ** remko () FreeBSD org

     /* Quis custodiet ipsos custodes */


-------------------------------------------------------------------------
This list sponsored by: SPI Dynamics

ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper 
It's as simple as placing additional SQL commands into a Web Form input box 
giving hackers complete access to all your backend systems! Firewalls and IDS 
will not stop such attacks because SQL Injections are NOT seen as intruders. 
Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! 

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
--------------------------------------------------------------------------