From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <3A865F4D.8CADD02B@linux.ru.net>
From: Anton Farygin <rider@linux.ru.net>
Organization: LRN Team
X-Mailer: Mozilla 4.76 [ru] (X11; U; Linux 2.2.18-ipl1mdk i686)
X-Accept-Language: en
MIME-Version: 1.0
To: devel@linux.iplabs.ru
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 8bit
Subject: [devel] [Fwd: Re: [BUGTRAQ] Linux kernel sysctl() vulnerability]
Sender: devel-admin@linux.iplabs.ru
Errors-To: devel-admin@linux.iplabs.ru
X-BeenThere: devel@linux.iplabs.ru
X-Mailman-Version: 2.0
Precedence: bulk
Reply-To: devel@linux.iplabs.ru
List-Help: <mailto:devel-request@linux.iplabs.ru?subject=help>
List-Post: <mailto:devel@linux.iplabs.ru>
List-Subscribe: <http://www.logic.ru/mailman/listinfo/devel>,
	<mailto:devel-request@linux.iplabs.ru?subject=subscribe>
List-Id: IPLabs Linux Team Developers mailing list <devel.linux.iplabs.ru>
List-Unsubscribe: <http://www.logic.ru/mailman/listinfo/devel>,
	<mailto:devel-request@linux.iplabs.ru?subject=unsubscribe>
List-Archive: <http://www.logic.ru/pipermail/devel/>
X-Original-Date: Sun, 11 Feb 2001 12:45:49 +0300
Date: Sun, 11 Feb 2001 12:45:49 +0300
Archived-At: <http://lore.altlinux.org/devel/3A865F4D.8CADD02B@linux.ru.net/>
List-Archive: <http://lore.altlinux.org/devel/>
List-Post: <mailto:devel@altlinux.org>

Мне кажется стоит в ядро патч включить.

Rgds
Anton


-------- Original Message --------
Subject: Re: [BUGTRAQ] Linux kernel sysctl() vulnerability
Date: Sat, 10 Feb 2001 10:28:01 +0100
From: Florian Weimer <Florian.Weimer@RUS.UNI-STUTTGART.DE>
Reply-To: Florian Weimer <Florian.Weimer@RUS.UNI-STUTTGART.DE>
To: BUGTRAQ@SECURITYFOCUS.COM
References:
<Pine.LNX.4.30.0102091259040.32418-100000@ferret.lmh.ox.ac.uk>

Chris Evans <chris@SCARY.BEASTS.ORG> writes:

> There exists a Linux system call sysctl() which is used to query and
> modify runtime system settings. Unprivileged users are permitted to query
> the value of many of these settings.

It appears that all current Linux kernel version (2.2.x and 2.4.x) are
vulnerable.  Right?

Was it really necessary to release this stuff just before the weekend?

The following trivial patch should fix this issue. (I wonder how you
can audit code for such vulnerabilities.  It's probably much easier to
rewrite it in Ada. ;-)

--- sysctl.c    2001/02/10 09:42:12     1.1
+++ sysctl.c    2001/02/10 09:42:26
@@ -1123,7 +1123,7 @@
                  void *oldval, size_t *oldlenp,
                  void *newval, size_t newlen, void **context)
 {
-       int l, len;
+       unsigned l, len;

        if (!table->data || !table->maxlen)
                return -ENOTDIR;

--
Florian Weimer 	                  Florian.Weimer@RUS.Uni-Stuttgart.DE
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898
_______________________________________________
Devel mailing list
Devel@linux.iplabs.ru
http://www.logic.ru/mailman/listinfo/devel