Linux ps Vulnerability
BID:360
Info
Linux ps Vulnerability
| Bugtraq ID: | 360 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 13 1999 12:00AM |
| Updated: | Jun 13 1999 12:00AM |
| Credit: | First posted to BugTraq by alpen <[email protected]> on June 14, 1999. |
| Vulnerable: |
SuSE Linux 6.1 Slackware Linux 4.0 Pacific HiTech TurboLinux 1.2 |
| Not Vulnerable: |
Redhat Linux 6.0 |
Discussion
Linux ps Vulnerability
In recent Linux distributions, the ps binary is defective and creates a subtle vulnerability for the operating system as a whole. When processes are running in the background and belong to a user who is deleted via deluser, a regular ps aux will not display them. This is because the user is removed from /etc/passwd. When ps tries to lookup the userid in /etc/passwd for a username, it finds nothing and will not display the process at all.
In recent Linux distributions, the ps binary is defective and creates a subtle vulnerability for the operating system as a whole. When processes are running in the background and belong to a user who is deleted via deluser, a regular ps aux will not display them. This is because the user is removed from /etc/passwd. When ps tries to lookup the userid in /etc/passwd for a username, it finds nothing and will not display the process at all.
Exploit / POC
Linux ps Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Linux ps Vulnerability
Solution:
The ghost processes can be listed with the defective ps by typing ps -aunx. The reason for this is because the n flag tells ps not to lookup the username in /etc/passwd.
Solution:
The ghost processes can be listed with the defective ps by typing ps -aunx. The reason for this is because the n flag tells ps not to lookup the username in /etc/passwd.
References
Linux ps Vulnerability
References:
References: