Date: Thu, 7 Sep 2006 20:23:04 +0200
To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Subject: Linux kernel source archive vulnerable
Message-ID: <20060907182304.GA10686@danisch.de.>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.12-2006-07-14
From: hadmut@danisch.de (Hadmut Danisch)
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hi,
there's a severe vulnerability in the Linux kernel source code archives:
The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.
When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.
This opens the door for at least three kinds of attacks:
1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
world writable directories at a well defined place, perfect to hide
any malware, bot, rootkit,...
2. Any user or intruder can modify the kernel source and thus compromise
the kernel to be compiled.
3. any user or intruder could modify the build or installation
system/Makefiles in order to have any kind of malware executed by
root the next time a kernel is built or installed, or any other
kernel module making use of the kernel tree.
Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.
regards
Hadmut
