security of fileutils (Re: Release of 2.4.21)

Pavel Machek
2003-03-24T22:02:27Z

Hi!

> This specific ptrace hole is closed, yay. Now what about the other
> 10,001 that still exist? People are blowing this ptrace bug WAY
> out of proportion. The only reason why it demands a modicum of
> vendor responsibility is that a-holes are making easy-to-use exploits
> available for the script kiddies.
>
> In my more cynical moods, I wish bugtraq'ers would start posting
> exploits to all the races in GNU coreutils (cp/mv/rm/...). Assuming
> such actions would (finally) lead to bug fixes.... maybe then I will
> start taking local root holes a bit more seriously. I will no more
> than hint about this in public, but will respond privately with details
> (if I know you).

Can you give me the details? I can
imagine holes like "if I can force root
to rm -rf /tmp/my-dir while my scripts
are running, I can rm whatever I want"
and probably could force root to cp
files he did not want to copy, but that
would require a *lot* of social ingeneering...
Unlike ptrace which seems to be "gimme root, now!"
case.
Pavel
(I left l-k in cc, you may want to strip it)
--
Pavel
Written on sharp zaurus, because my Velo1 broke. If you have Velo you don't need...