Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Potential warning: 10.3.9 disables SUID/SGID flag' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Potential warning: 10.3.9 disables SUID/SGID flag
Authored by: gshenaut on Apr 18, '05 06:35:28PM

I don't get what you are trying to say. In what sense is a suid shell script equivalent to a suid shell, any more than a suid binary that you have write permission on is a suid shell? If you can't write to the command, then you can't change it, so a suid shell script can be as secure as any other command. If you can write to a suid binary, then you can replace it, for example, by copying a shell on top of it, so a suid binary can be as insecure as any script.

Set-user-id security is all about using suid commands only when necessary, and protecting access to them. It's not about egregiously disallowing setuid for an entire class of commands.

Greg Shenaut



[ Reply to This | # ]
Potential warning: 10.3.9 disables SUID/SGID flag
Authored by: a1291762 on Apr 18, '05 07:36:40PM

All it takes is one setuid script that can be modified by you or that points to a binary you can overwrite and you can be compromised.

eg. change the first line of the script to
#!/mypath/mybadprogram

or find that the script with #!/usr/local/bin/tclsh points to a file you can write to, replace it with your own binary.

In both of these cases your binary is going to be running with the SUID/SGID permissions. Sure, Apple can ship a base system that doesn't contain a flaw but how can they protect against third parties or stupid users? Other Unix OSes have already disabled this feature, Apple is actually behind here.



[ Reply to This | # ]
Potential warning: 10.3.9 disables SUID/SGID flag
Authored by: gshenaut on Apr 18, '05 08:01:38PM
Y'all are missing the point. It's not that writable, setuid scripts are insecure, it's that writable, setuid commands, of any kind, are insecure. Take /sbin/mount_nfs, which is "setuid Mach-O executable ppc" on my system and I assume on everyone's : if you have write permission on that file, you can overwrite it with /bin/sh and you'll have a suid shell. If you don't have write permission on it, then you can't. The situation with a setuid script is exactly the same!!.

Greg Shenaut

[ Reply to This | # ]

Potential warning: 10.3.9 disables SUID/SGID flag
Authored by: CoolerQ on Apr 18, '05 08:19:58PM

You all seem to be forgetting that this particular security hole was closed a long time ago. Whenever a setuid file is opened for writing, by anyone, the setuid bit is dropped. The owner must then chmod it to get the setuid back. This prevents someone from performing the attack you just described.

--Quentin



[ Reply to This | # ]