[Full-Disclosure] /bin/rm file access vulnerability

[Alex V. Lukyanenko]

Nice joke.
And the amount and the seriousness of the replies means that lots of
us security people need to have a little break, so
                   ... Happy new year everyone.

-- 
Alex V. Lukyanenko | 86195208 at icq | y_avenger_y at ua.fm

LH> /bin/rm file access vulnerability

LH> Affected Products:
LH>          /bin/rm (all versions, tested on FreeBSD and linux)
LH>          (http://www.freebsd.org    http://www.kernel.org)

LH> Author:
LH>          Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
LH>          xenzeo at blackhat dot dk


LH> /bin/rm is a program that removes the named file arguments on unix systems.
LH> When /bin/rm is called it checks the file's permissions and the id of the user
LH> trying to remove the file. If the user does not have the required permissions
LH> to delete the file, /bin/rm will simply reject and exit.

LH> However, it is possible for a person with admin rights (root) to 
LH> delete _any_ file
LH> on the system regardless of who has created it and what it's permissions are.

LH> Proof of concepts:
LH> $ touch /home/xenzeo/file
LH> $ ls -l /home/xenzeo/file
LH> -rw-r--r--  1 xenzeo none 0 Dec 30  2004 /home/xenzeo/file
LH> $ id
LH> uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
LH> $ su -c 'rm -f /home/xenzeo/file'
LH> $ ls -l /home/xenzeo/file
LH> ls: file: No such file or directory

LH> #!/usr/bin/perl
LH> if ($#ARGV != 0) {
LH> 	die "usage: rm-exploit.pl file\r\n";
LH> } else {
LH>     $file = $ARGV[0];
LH>     print "*** CMD: [ /bin/rm -f $file ]\r\n";
LH>     print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
LH>     if ($> == 0) {
LH>        print "[-] EXECUTING CMD\r\n";
LH>        system("/bin/rm -f $file");
LH>        print "[-] DONE\r\n";
LH>        print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
LH>        exit();
LH>     } else {
LH>        print "[-] EXPLOIT FAILED\r\n";
LH>        print "[-] YOU ARE NOT ROOT\r\n";
LH>        print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
LH>     }
LH> }

LH> Vender status:
LH>          Neither FreeBSD nor Linux developers have been contacted yet!

LH> -Xenzeo