R: Linux kernel source archive vulnerable
Hi Hadmut, by the way cross post is bad so I'll reply only in bugtraq. The ones
you
report are not, IMHO, vulnerability in Linux Kernel source code archive.
May be you want to administer your severs ina secure fashoned way involving a
proper ownership access to /user/src and /lib/modules path ensuring that
regular
user belonging to special group can write into it.
If "compile it's usually done as root" is not a kernel vulnerability but a non
secure
aware sysadmin behaviour.
Consider "--no-same-owner" or "--owner" tar flags in order to customize
extracted
file ownership.
Anyway just few considerations:
1) a server exposed to Interne, is NOT supposed to have compiler installed in
it.
You may use a compile machine to build custom kernel and installing to your
production
environment or you may want to use your ditribution kernel package.
So you don't need to have /usr/src/linux at all.
2) a good sysadmin is aware that /usr/src is NOT supposed to be world writable
Anyway... I don't think this is a "severe vulnerability in the Linux kernel
source code
archives". IMHO, of course
My 0,02EUR
sp0nge
________________________________
Da: Hadmut Danisch [mailto:hadmut@xxxxxxxxxx]
Inviato: gio 07/09/2006 20.23
A: full-disclosure@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
Oggetto: Linux kernel source archive vulnerable
Hi,
there's a severe vulnerability in the Linux kernel source code archives:
The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.
When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.
This opens the door for at least three kinds of attacks:
1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
world writable directories at a well defined place, perfect to hide
any malware, bot, rootkit,...
2. Any user or intruder can modify the kernel source and thus compromise
the kernel to be compiled.
3. any user or intruder could modify the build or installation
system/Makefiles in order to have any kind of malware executed by
root the next time a kernel is built or installed, or any other
kernel module making use of the kernel tree.
Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.
regards
Hadmut
--
The information transmitted is intended for the person or entity to which it is
addressed and may contain confidential and/or privileged material. Any review,
retransmission, dissemination or other use of, or taking of any action in
reliance upon, this information by persons or entities other than the intended
recipient is prohibited. If you received this in error, please contact the
sender and delete the material from any computer.