SecurityFocus

aterm 0.4.2 tty permission weakness Jul 13 2004 04:04PM
Maarten Tielemans (TTIelu_DaInfraCrew hotmail com) (4 replies)

Re: [security] aterm 0.4.2 tty permission weakness Jul 14 2004 10:26AM
lorenzo (lagrespan gmail com)

Re: aterm 0.4.2 tty permission weakness Jul 14 2004 09:59AM
Sebastian Hans (hanss in tum de)

Maarten Tielemans wrote:
>
>
> Aterm has an issue with creating a terminal.
>
> A quick ?ls ?al? on a aterm with ?mesg y? shows:
> crw--w--w- 1 alsdk users 5, 3 Jul 13 17:27 /dev/ttyp3
> with ?mesg n?:
> crw-----w- 1 alsdk users 5, 3 Jul 13 17:28 /dev/ttyp3
>
> 1) World (nobody) is able to ?echo? or ?cat? towards the terminal
> echo ?hello? >> /dev/ttyp3
> cat mkdir >> /dev/ttyp3
> 2) The group seems to be incorrect, a normal terminal has default group tty

When using devpts, it looks good:

$ mesg
is y
$ ls -Al /dev/pts/0
crw--w---- 1 phi xxx 136, 0 Jul 14 11:25 /dev/pts/0
$ mesg n
$ ls -Al /dev/pts/0
crw------- 1 phi xxx 136, 0 Jul 14 11:26 /dev/pts/0

Cheers

Seb
--
/~\ The ASCII Sebastian Hans
\ / Ribbon Campaign hanss (at) in.tum (dot) de [email concealed]
X Against HTML 0x5AED1E6D
/ \ Email! 014C 4A54 FED4 C0B5 3E87 427B 6910 AB0A 5AED 1E6D

[ reply ]

Re: aterm 0.4.2 tty permission weakness Jul 14 2004 07:47AM
Armin Wolfermann (aw osn de)

Re: aterm 0.4.2 tty permission weakness Jul 14 2004 04:10AM
Coleman Kane (cokane cokane org)