Bugtraq: Re: aterm 0.4.2 tty permission weakness

[Sebastian Hans <hanss () in tum de>]

Maarten Tielemans wrote:
> Aterm has an issue with creating a terminal.
>
> A quick ?ls ?al? on a aterm with ?mesg y? shows:
> crw--w--w-  1 alsdk  users    5,   3 Jul 13 17:27 /dev/ttyp3
> with ?mesg n?:
> crw-----w-  1 alsdk  users    5,   3 Jul 13 17:28 /dev/ttyp3
>
> 1) World (nobody) is able to ?echo? or ?cat? towards the terminal
> echo ?hello? >> /dev/ttyp3
> cat mkdir >> /dev/ttyp3 
> 2) The group seems to be incorrect, a normal terminal has default group tty
When using devpts, it looks good:

$ mesg
is y
$ ls -Al /dev/pts/0
crw--w----  1 phi xxx 136, 0 Jul 14 11:25 /dev/pts/0
$ mesg n
$ ls -Al /dev/pts/0
crw-------  1 phi xxx 136, 0 Jul 14 11:26 /dev/pts/0

Cheers

Seb
-- 
/~\ The ASCII                                             Sebastian Hans
\ / Ribbon Campaign                                      hanss () in tum de
 X  Against HTML                                              0x5AED1E6D
/ \ Email!            014C 4A54 FED4 C0B5 3E87  427B 6910 AB0A 5AED 1E6D

Attachment: _bin
Description: