BugTraq
Linux kernel source archive vulnerable Sep 07 2006 06:23PM
hadmut danisch de (Hadmut Danisch) (2 replies)
Hi,

there's a severe vulnerability in the Linux kernel source code archives:

The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:

1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
world writable directories at a well defined place, perfect to hide
any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
the kernel to be compiled.

3. any user or intruder could modify the build or installation
system/Makefiles in order to have any kind of malware executed by
root the next time a kernel is built or installed, or any other
kernel module making use of the kernel tree.

Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

[ reply ]
Re: Linux kernel source archive vulnerable Sep 08 2006 03:55PM
Gerald (Jerry) Carter (jerry samba org)
R: Linux kernel source archive vulnerable Sep 08 2006 08:43AM
Perego Paolo Franco (p perego reply it)


 

Privacy Statement
Copyright 2010, SecurityFocus