Home page logo

bugtraq logo Bugtraq mailing list archives

Digital UNIX/Irix mesg problem
From: tom () SBA MIAMI EDU (Tom Leffingwell)
Date: Tue, 29 Apr 1997 15:06:50 -0400

        This is rather stupid and not much of a bug, but it shouldn't
happen.  Basically, the permissions on your tty are set correctly, with
messages on, during login.  If you turn them off, and then turn them back
on, your tty becomes world writable.  (Actually, you don't have to turn
them off, mesg y automatically sets permissions that way).  I don't
remember that being that way in Digital UNIX 3, but I can't think of a box
to check it on.  I noticed that Ultrix, FreeBSD, and Solaris don't have
this problem.  I also noticed that Irix does the same thing (has the
problem).  I did call DEC, but they seemed rather confused.  I don't see
any reason for this.  Nothing to exploit, but I guess people could easily
fake a write from another user, or send annoying things anonymously
(cat /vmunix > /dev/ttyXX).

% tty
% ls -l /dev/ttyp4
crw--w----   2 tom      terminal   6,  4 Apr 29 14:50 /dev/ttyp4
% mesg n
% ls -l /dev/ttyp4
crw-------   2 tom      terminal   6,  4 Apr 29 14:50 /dev/ttyp4
% mesg y
% ls -l /dev/ttyp4
crw--w--w-   2 tom      terminal   6,  4 Apr 29 14:50 /dev/ttyp4


Tom Leffingwell                Office: Jenkins 314K
Systems Manager                Office Phone: (305) 284-1962
Network Security               Email: tom () sba miami edu

School of Business
University of Miami

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]