mailing list archives
Re: Vunerability in HP sysdiag ?
From: tsr () cave isdn cs tu-berlin de (Tobias Richter)
Date: Wed, 25 Sep 1996 22:26:27 +0200
[rest of message deleted]
I verified it for HP-UX 9.0X. Not only that, though. It is not sufficient
to chmod u-s /bin/sysdiag. This leaves behind a bunch of programs in
/usr/diag/bin which are still setuid to root and behave quite the same
(i.e., they don't check for symlinks while creating 0666 log or temp
files). A non-priviledged user can use any of these to create 0666
/.rhosts (or whatever else) files, with the known consequences.
But also priviledged users create these 0666 files and will follow
bogus symlinks, too. You just have to create your symlink and wait
for root to do his regular work. Therefore this:
root# chmod u-s /bin/sysdiag /usr/diag/bin/*
is not enough. You will have to
root# chmod a-x /bin/sysdiag /usr/diag/bin/*
or get a patch quick.
Tobias Richter Try my Homepage: file:/dev/zero