Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 21819 - xlock runs fortune command.
xlock runs fortune command.
Status: CLOSED NOTABUG
Product: Red Hat Linux
Classification: Retired
Component: xlockmore (Show other bugs)
6.2
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Harald Hoyer
: Security
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2000-12-06 14:39 EST by Jeremiah Johnson
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-12-06 14:39:35 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Jeremiah Johnson 2000-12-06 14:39:32 EST 
When xlock is running, it may run the fortune command for one of its screen
savers.  The fortune program on redhat 6.2 resides in /usr/games.  By
default this is not in anybodies $PATH.  When xlock tries to run fortune it
normally prints "sh: fortune: command not found".  To test a theory I
created a file in /bin called fortune.  It included the following.

[root@inflammation /bin]# cat fortune 
cp /bin/bash /tmp
chmod +s /tmp/bash
/usr/games/fortune

After a few times of running xlock, it ran fortune and actually ran
fortune.  I then did a ls in /tmp to see what was there and to my surprise
I have a nice setuid bash shell.

[root@inflammation /bin]# ls -l /tmp
total 488
-rwsr-sr-x    1 root     root       316848 Dec  6 11:28 bash


I realize that by default it would be hard to put such a script in any of
the standard bin paths (/bin:/usr/bin:/sbin:/usr/sbin etc).  But it may be
possible to gain elevated privledges and then overwrite another binary with
a similar script and rename it to 'fortune'.
Comment 1 Harald Hoyer 2000-12-15 08:59:51 EST 
If you can place s.th. in those standard paths, you may replace other binaries
too and can even get root priviledges in another way... so I say: no bug!
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.