Re: Bitkeeper licence issues

[Ben Collins]

On Tue, Mar 19, 2002 at 03:44:36PM -0800, Larry McVoy wrote:
> On Tue, Mar 19, 2002 at 03:27:59PM -0800, David S. Miller wrote:
> >    From: Larry McVoy <[e-mail]>
> >    Date: Tue, 19 Mar 2002 15:25:02 -0800
> > 
> >    Come on Pavel, in order to make this happen, you have to
> >    
> >    	a) run the installer as root
> >    	b) know the next pid which will be allocated
> >    	c) put the symlink in /tmp/installer$pid
> >    
> > Exploit: Make all 65535 $pid simlinks
> > 
> > It's very exploitable actually, and is similar in vein to
> > all the ancient mktemp stuff.
> 
> Hey Dave, are you suggesting that no such exploits exist in Red Hat's 
> rpm system?  In order for that to be true, rpm would have to be making
> sure that each and every directory along any path that it writes is
> not writable except by priviledged users.  I just checked, it doesn't.

That's because the admin would have had to change those perms on
purpose, which means they left themselves open to the attack.

Larry, check bugtraq archives. You'll see mounds of these types of
exploitable problems. All of them very serious.

> At some point, people get to take responsibility for their own choices.

Then just admit it was a bad thing and leave it be? :) Come on, it was a
mistake, and a very common one. Just don't make it out to be less than
what it is.

-- 
 .----------=======-=-======-=========-----------=====------------=-=-----.
/       Ben Collins    --    Debian GNU/Linux    --    WatchGuard.com      \
`          [e-mail]   --   [e-mail]           '
 `---=========------=======-------------=-=-----=-===-======-------=--=---'