Re: [FD] Back To The Future: Unix Wildcards Gone Wild

[Nick Lindridge <nick@xxxxxxxxxxx>]

This is an interesting old trick but not any fault with the wildcard 
mechanism (though a bit array indicating whether an argv item is the 
result of an expansion would be nice). Taking the rm program as an 
example, the vulnerability report should really be citing rm as 
vulnerable for failing to factor knowledge of this behaviour into some 
sanity checking. As a start, rm could test to see whether any of the 
command line options match files to be removed, knowing that the option 
could then have come from an unintended wildcard expansion. The program 
could then require an option to force the operation.

If we accept therefore that the deficiency is with the utilities 
themselves, perhaps you could research and contribute a vulnerability 
report that lists all of the commonly used programs that could be 
affected by this behaviour. Such a report could set the basis for a road 
map of improvement in the listed utilities.

Nick

On 26/06/2014 09:40, defensecode wrote:
> Hi,
>
> We wanted to inform all major *nix distributions via our responsible
> disclosure policy about this problem before posting it, because it is
> highly likely that this problem could lead to local root access on many
> distributions. But, since part of this research contained in the document
> was mentioned on some blog entries, we are forced to release it in a
> full version.
>
> Download URL:
> http://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt
>
> Regards,
> Leon Juranic
>
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

--
Best regards
Nick
--
ionCube Software LLP
@ioncube / uk.linkedin.com/in/nicklindridge
+44-208-099-3608


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/