|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> SuSE Local Security Checks >> SUSE-SA:2005:062: permissions Vulnerability Assessment Details
|
SUSE-SA:2005:062: permissions |
||
Check for the version of the permissions package Detailed Explanation for this Vulnerability Assessment The remote host is missing the patch for the advisory SUSE-SA:2005:062 (permissions). SUSE LINUX ships with three pre defined sets of permissions, 'easy', 'secure' and 'paranoid'. The chkstat program contained in the permissions package is used to set those permissions to the chosen level. Level 'easy' which is the default permits some world writeable directories. /usr/src/packages/RPMS and subdirectories is among them. To prevent users from playing tricks in there e.g. linking to /etc/shadow chkstat doesn't touch symlinks or files with an hardlink count != 1. Stefan Nordhausen discovered a way to trick this check. To gain access to e.g. /etc/shadow a malicious user has to place a hardlink to that file at a place that is modified by chkstat. chkstat will not touch the file because it has a hardlink count of two. However, if the administrator modifies the user database the original /etc/shadow gets deleted and replaced by a new one. That means the hardlink count of the file created by the malicious user drops to one. At this point chkstat will modify the file's permissions so anyone can read it. So it's technically impossible for chkstat to modify permissions of files in world writeable directories in a secure way. One such world writeable directoy in level 'easy' is /usr/src/packages/RPMS. Only subdirectories need to be adjusted in this case. Since normal users cannot create hard links to directories the problem can be solved by telling chkstat to not accept regular files. Another problematic directory is /var/games. Only members of group 'games' may write to it but it's likely that games with setgid 'games' are exploitable to permit user to gain group 'games' membership. The updated permissions package now tells chkstat when to only accept directories and no longer touches anything below /var/games to solve the described problems. On SUSE Linux 9.0 xmcd contained world writeable directories that suffered from the same problems. Updated xmcd packages for SUSE Linux 9.0 are therefore provided as well. We like to thank Stefan Nordhausen for pointing out the problems. Solution : http://www.suse.de/security/advisories/2005_62_permissions.html Network Security Threat Level: Medium Networks Security ID: Vulnerability Assessment Copyright: This script is Copyright (C) 2005 Tenable Network Security |
||
Cables, Connectors |
***NEW*** BCM RX67Q Gaming Motherboard | Intel Q67 2nd/3rd Gen. | LGA1155 | DDR3
$29.77
ASUS H110M-R Motherboard Intel 6th/7th Gen LGA1151 DDR4 Micro-ATX i/o shield
$42.00
GIGABYTE B560M DS3H AC LGA1200 Intel B560 SATA 6Gb/s Micro ATX Intel Motherboard
$64.99
Asus Prime H310M-A R2.0 Intel LGA 1151 DDR4 Desktop Motherboard
$46.99
Micro ATX Desktop Motherboard ASUS H110M-C LGA 1151
$31.95
MSI B450M PRO-VDH MAX AM4 AMD B450 USB3.2 Micro-ATX Motherboard
$67.99
Gigabyte AMD B550 UD AC Gaming Motherboard - AMD B550 Chipset - AM4 Socket - AMD
$89.99
Asus Prime B250M-C Motherboard Supports DDR4 Intel 7th Gen
$39.99
GIGABYTE MB10-Datto Motherboard Xeon D-1521- SR2DF 2.40 GHz- Open Box
$112.00
BTC-S37 Mining Motherboard Kit /w SSD & Ram Preinstalled
$59.99
|
||
No Discussions have been posted on this vulnerability. |