Vulnerability Development: Re: /dev/urandom | logger "issue"

[Michal Zalewski <lcamtuf () DIONE IDS PL>]

On Mon, 21 Aug 2000, Vitaly McLain wrote:

> I know I'll probably wind up sounding like an idiot, but why is that on
> Linux boxes normal users have so much access to /var/log/messages via
> "logger"? Any user can do:
>
> cat /dev/urandom | logger &
On Linux boxes, you have 0666 permissions on /dev/log. That's it, you can
not only forge messages (logger -p 0 -t kernel "blah"), but also... forge
date (I reported it some time ago, and written nice utility called suncat
- uc - for I/O operations on unix sockets from command-line).

Smart people changes these permissions to something more restrictive.

_______________________________________________________
Michal Zalewski [lcamtuf () tpi pl] [tp.internet/security]
[http://lcamtuf.na.export.pl] <=--=> bash$ :(){ :|:&};:
=-----=> God is real, unless declared integer. <=-----=