Subject: R: Linux kernel source archive vulnerable
Date: Fri, 8 Sep 2006 10:43:12 +0200
Message-ID: <D432C2F98B6D1B4BAE47F2770FEFD6B612B8B7@to1mbxs02.replynet.prv.>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Linux kernel source archive vulnerable
thread-index: AcbS7rJgRzlJ3gi2SdOCE5rewoRNegAMvibo
References: <20060907182304.GA10686@danisch.de.>
From: "Perego Paolo Franco" <p.perego@reply.it.>
To: "Hadmut Danisch" <hadmut@danisch.de.>, <bugtraq@securityfocus.com.>
X-OriginalArrivalTime: 08 Sep 2006 08:39:29.0384 (UTC) FILETIME=[4C954E80:01C6D322]
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hi Hadmut, by the way cross post is bad so I'll reply only in bugtraq. =
The ones you=20
report are not, IMHO, vulnerability in Linux Kernel source code archive.
May be you want to administer your severs ina secure fashoned way =
involving a=20
proper ownership access to /user/src and /lib/modules path ensuring that =
regular=20
user belonging to special group can write into it.
If "compile it's usually done as root" is not a kernel vulnerability but =
a non secure=20
aware sysadmin behaviour.=20
Consider "--no-same-owner" or "--owner" tar flags in order to customize =
extracted
file ownership.
=20
Anyway just few considerations:
1) a server exposed to Interne, is NOT supposed to have compiler =
installed in it.=20
You may use a compile machine to build custom kernel and installing to =
your production=20
environment or you may want to use your ditribution kernel package.
So you don't need to have /usr/src/linux at all.
2) a good sysadmin is aware that /usr/src is NOT supposed to be world =
writable
=20
Anyway... I don't think this is a "severe vulnerability in the Linux =
kernel source code
archives". IMHO, of course
=20
My 0,02EUR
=20
sp0nge
________________________________
Da: Hadmut Danisch [mailto:hadmut@danisch.de.]
Inviato: gio 07/09/2006 20.23
A: full-disclosure@lists.grok.org.uk; bugtraq@securityfocus.com
Oggetto: Linux kernel source archive vulnerable
Hi,
there's a severe vulnerability in the Linux kernel source code archives:
The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.
When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.
This opens the door for at least three kinds of attacks:
1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
world writable directories at a well defined place, perfect to hide
any malware, bot, rootkit,...
2. Any user or intruder can modify the kernel source and thus compromise
the kernel to be compiled.
3. any user or intruder could modify the build or installation
system/Makefiles in order to have any kind of malware executed by
root the next time a kernel is built or installed, or any other
kernel module making use of the kernel tree.
Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.
regards
Hadmut
--
The information transmitted is intended for the person or entity to =
which it is addressed and may contain confidential and/or privileged =
material. Any review, retransmission, dissemination or other use of, or =
taking of any action in reliance upon, this information by persons or =
entities other than the intended recipient is prohibited. If you =
received this in error, please contact the sender and delete the =
material from any computer.
