Solaris Tape Device Permissions Vulnerability
BID:445
Info
Solaris Tape Device Permissions Vulnerability
| Bugtraq ID: | 445 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 21 1998 12:00AM |
| Updated: | Oct 21 1998 12:00AM |
| Credit: | First posted to BugTraq by Joshua Grubman <[email protected]> on Oct 21, 1998. |
| Vulnerable: |
Sun Solaris 2.6_x86 Sun Solaris 2.6 |
| Not Vulnerable: | |
Discussion
Solaris Tape Device Permissions Vulnerability
The default permissions assigned to scsi tape devices (/dev/rmt*) allow for users to write and read data to and from the device on Solaris machines. The permissions for the devices are automatically set to mode 666. If an admin were to backup files like /etc/shadow, a malicious user could extract the archives and have full read ability on all of the files.
The default permissions assigned to scsi tape devices (/dev/rmt*) allow for users to write and read data to and from the device on Solaris machines. The permissions for the devices are automatically set to mode 666. If an admin were to backup files like /etc/shadow, a malicious user could extract the archives and have full read ability on all of the files.
Exploit / POC
Solaris Tape Device Permissions Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Solaris Tape Device Permissions Vulnerability
Solution:
The correct and recommend fix is to run bsmconv to turn on device allocation. This sets all of the device files for removable media devices such as tapes to 0000. A user who then wants to use a tape should then:
allocate st0
insert tape into drive
tar/ufs*/cpio/dd whatever
remove tape from drive
dealloate st0
The same applies to audio and cd devices, though the audio devices are better dealt with using /etc/logindevperm. If you are concerned about security on Solaris you should always run bsmconv to turn on auditing and device allocation and run ASET to ensure other perms etc are sorted out. (/usr/aset/aset -l high -p)
Solution:
The correct and recommend fix is to run bsmconv to turn on device allocation. This sets all of the device files for removable media devices such as tapes to 0000. A user who then wants to use a tape should then:
allocate st0
insert tape into drive
tar/ufs*/cpio/dd whatever
remove tape from drive
dealloate st0
The same applies to audio and cd devices, though the audio devices are better dealt with using /etc/logindevperm. If you are concerned about security on Solaris you should always run bsmconv to turn on auditing and device allocation and run ASET to ensure other perms etc are sorted out. (/usr/aset/aset -l high -p)
References
Solaris Tape Device Permissions Vulnerability
References:
References: