openssh unix dev - Jan 2001 - Glibc Local Root Exploit (fwd)

-------------- next part --------------
An embedded message was scrubbed...
From: Charles Stevenson <csteven at NEWHOPE.TERRAPLEX.COM>
Subject: Glibc Local Root Exploit
Date: Wed, 10 Jan 2001 00:06:48 -0700
Size: 3299
Url:
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20010111/271074f0/attachment.mht

>Hi all,                                                                    
>  This has been bouncing around on vuln-dev and the debian-devel
>lists. It effects glibc >= 2.1.9x and it would seem many if not all OSes
>using these versions of glibc. Ben Collins writes, "This wasn't
supposed
>to happen, and the actual fix was a missing comma in the list of secure
>env vars that were supposed to be cleared when a program starts up
>suid/sgid (including RESOLV_HOST_CONF)." The exploit varies from system
>to system but in our devel version of Yellow Dog Linux I was able to
>print the /etc/shadow file  as a normal user in the following manner:
Hmm.. What a wonderful way to start my morning.  I can sure confirm that
OpenSSH's ssh w/ RESOLV_HOST_CONF set to /etc/shadow works great for
pulling up passwords on Redhat 7.0/intel (glibc 2.2).

I'm guess I should be thankful I don't run a shell server.

Wonder if NSA's involvement in Linux will improve it. <sigh>

- Ben