On Mon, 20 Nov 2000, Mark McLoughlin wrote:
>> - Do you not need to be root to use ping -I in the first place,
nope.. ping is setuid to root on most systems. (eg RH).
> Am I missing something here, just how does ping -I'blah de blah'
> end up giving you modprobe 'blah de blah'?
>
kernel sees there is no interface called 'blah de blah'. kernel
invokes modprobe to try configure this interface and passes the 'blah
de blah' straight to modprobe. modprobe at some points execs a shell
(for a reason i can't remember - insmod maybe) with
binary 'blah de blah'
now imagine if 'blah de blah' is: "; chmod a+w /", then shell will
get:
binary ; chmod a+w /
the ping case is just an example. the real problem is that neither the
kernel nor modutils check data that came from an unpriviledged source
when invoking priviledged commands.
--paulj
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
