[comp.unix.ultrix] Ultrix x.x /etc/rc.local security holes via /tmp/t1

D. Allen [CGL]" <idallen@watcgl.waterloo.edu> (02/28/91)

You'll like this one; it's so simple.

On Ultrix (any version), if you happen to have directories named
/tmp/t1 or /tmp/t2, all kinds of nasty things will happen to your
/etc/motd and /etc/gettytab because /etc/rc.local assumes it can write
to these tmp names as files, and it edits the contents into your
/etc/motd and /etc/gettytab.  Nobody checks the error returns on any of
these commands, so if the names are directories, well, you get a mess.

The problem is even neater than this, since rc.local doesn't remove /tmp/t1
before writing into it, and the writing is done *before* clearing /tmp.

So J.Q. Twit on your machine just makes this symlink:

   % ln -s /vmunix /tmp/t1

and the next time your machine reboots, your rc.local wipes out your vmunix.
Actually, to be most destructive, link /tmp/t2 to /vmunix and /tmp/t1 to,
say, /etc/passwd or something.  Then rc.local will clobber both of them.

Standard rules of (shell) programming:

   - pick unique names for your temp files
   - remove your temp files before you write into them
   - check all your error returns and don't barge ahead with bad data

This problem with /tmp/t1 has been in every version of Ultrix since I
started counting somewhere back around Ultrix 2.0-1.  If DEC had an
electronic SPR clearing house, you probably wouldn't be reading this now.
-- 
-IAN! (Ian! D. Allen) idallen@watcgl.uwaterloo.ca idallen@watcgl.waterloo.edu
 [129.97.128.64]  Computer Graphics Lab/University of Waterloo/Ontario/Canada

brendan@cs.widener.edu (Brendan Kehoe) (02/28/91)

In <1991Feb28.083356.6769@watcgl.waterloo.edu>, idallen@watcgl.waterloo.edu writes:
>On Ultrix (any version), if you happen to have directories named
>/tmp/t1 or /tmp/t2, all kinds of nasty things will happen to your
>/etc/motd and /etc/gettytab because /etc/rc.local assumes it can write
>to these tmp names as files, and it edits the contents into your
>/etc/motd and /etc/gettytab.

  Suns have the same problem; just change the /tmp/t1 and /tmp/t2
  names to /etc/t1 and /etc/t2 -- since rc.local's run as root, you'll
  be fine.

-- 
     Brendan Kehoe - Widener Sun Network Manager - brendan@cs.widener.edu
  Widener University in Chester, PA                A Bloody Sun-Dec War Zone

peirce@gumby.cc.wmich.edu (Leonard Peirce) (02/28/91)

In article <1991Feb28.131938.29631@cs.widener.edu> brendan@cs.widener.edu (Brendan Kehoe) writes:
>In <1991Feb28.083356.6769@watcgl.waterloo.edu>, idallen@watcgl.waterloo.edu writes:
>>On Ultrix (any version), if you happen to have directories named
>>/tmp/t1 or /tmp/t2, all kinds of nasty things will happen to your
>>/etc/motd and /etc/gettytab because /etc/rc.local assumes it can write
>>to these tmp names as files, and it edits the contents into your
>>/etc/motd and /etc/gettytab.
>
>  Suns have the same problem; just change the /tmp/t1 and /tmp/t2
>  names to /etc/t1 and /etc/t2 -- since rc.local's run as root, you'll
>  be fine.

You could just add

   rm -fr /tmp/t1 /tmp/t2

just before the edit to motd.

I always just comment out the entire mess.  I can maintain motd myself; I don't need
rc.local to change it for every reboot.

--
Leonard Peirce                  Internet:  peirce@gumby.cc.wmich.edu
Western Michigan University                peirce@gw.wmich.edu
Academic Computing Services     UUCP:      ...!uunet!sharkey!wmichgw!peirce
Kalamazoo, MI  49008            Phone:     (616) 387-5469

jch@dyfed.rdg.dec.com (John Haxby) (03/01/91)

You don't actually need these temporary files
at all.  I got fed up of waiting for the edit on reboot
so I re-wrote it to look like this:

------------------------------
VERSION=`echo version\?s |
         adb /vmunix - |
         sed -e 1d -e 's/_version:[  \t]*//'`  2>&1 > /dev/console
if [ "$VERSION" != "" ]
then echo $VERSION
     echo -n 'update /etc/motd ...'
     mv /etc/motd /etc/motd.BAK
     (echo $VERSION; grep -v ULTRIX /etc/motd.BAK) > /etc/motd

    echo -n ' update /etc/gettytab ...'
    VERSION=`echo $VERSION | sed 's/System.*//'`
    (echo '/^ULTRIX.*/s//'"$VERSION"'\\'; echo w) |
        ed /etc/gettytab > /dev/null
    echo ' done.'
fi 2>&1                                                         >/dev/console
---------------

(The \t is a tab).  I suspect a similar thing could be done for
a mips machine (that doesn't have adb); although you could
always go back and use the slow `strings' it needs be.
-- 
John Haxby, Definitively Wrong.
Digital				<jch@wessex.rdg.dec.com>
Reading, England		<...!ukc!wessex!jch>