SecurityFocus

Samba 3.x + kernel 2.6.x local root vulnerability Feb 09 2004 09:23PM
Michal Medvecky (M Medvecky sh cvut cz) (3 replies)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 10 2004 12:07AM
Felipe Franciosi (ozzybugt terra com br)

This is old news.

NFS is also affected by this CONFIGURATION PROBLEM (not a bug). What I
think might be a problem is this:

[...took_from_mount_man...]
OPTIONS
[...]
nosuid Do not allow set-user-identifier or set-group-identifier
bits to take effect. (This seems safe, but is in fact
rather unsafe if you have suidperl(1) installed.)
[...end_of_cut...]

I have never tried to use suidperl to "exploit" such thing, but my guess
is that suidperl somehow "see" the suid bit and can execute scripts set-
uid-ing the process... or maybe the man mount page was just talking
about some old suidperl bug... if someone knows, please tell me.

Best Regards,
Felipe

--
Felipe Franciosi <ozzybugt (at) terra.com (dot) br [email concealed]>

[ reply ]

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 09 2004 10:24PM
Michael Kjorling (michael kjorling com)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 09 2004 10:03PM
Seth Arnold (sarnold wirex com) (2 replies)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 10 2004 07:42AM
Frank Louwers (frank openminds be) (2 replies)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 12 2004 12:50AM
Darren Reed (avalon caligula anu edu au)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 11 2004 09:42PM
Urban Widmark (urban teststation com)

Re: Samba 3.x + kernel 2.6.x local root vulnerability Feb 09 2004 11:07PM
Patrick J. Volkerding (security slackware com)