Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY LINKS NEWS MAN DOCUMENTATION

<< Previous INDEX Search src / Print Next >>

Date: Thu, 7 Sep 2006 20:23:04 +0200
To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Subject: Linux kernel source archive vulnerable
Message-ID: <20060907182304.GA10686@danisch.de.>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.12-2006-07-14
From: hadmut@danisch.de (Hadmut Danisch)
X-Virus-Scanned: antivirus-gw at tyumen.ru

Hi,

there's a severe vulnerability in the Linux kernel source code archives:


The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:


1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
   world writable directories at a well defined place, perfect to hide
   any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
   the kernel to be compiled.

3. any user or intruder could modify the build or installation
   system/Makefiles in order to have any kind of malware executed by
   root the next time a kernel is built or installed, or any other
   kernel module making use of the kernel tree.


Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

<< Previous INDEX Search src / Print Next >>