[NEWS] Mac OS X Insecure pty Permissions
SecuriTeam <[email protected]>
| Newsgroups | gmane.comp.security.securiteam |
|---|---|
| Message-ID | <[email protected]> |
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html - - - - - - - - - Mac OS X Insecure pty Permissions ------------------------------------------------------------------------ SUMMARY pty is "a parallel terminal device in Unix that allow users to communicate with the operating system in command line". Mac OS X doesn't provide any mechanism for non-setuid-root programs to change permissions on ptys allowing any local user to sniff the tty connection. DETAILS Vulnerable Systems: * Mac OS X 10.3 family and prior Immune Systems: * Mac OS X 10.4 Due to lack of ability to change permissions of pty, xterms, screen sessions, and Terminal.app windows (with explicitly specified commands) are vulnerable to tty sniffing. Using Terminal.app's standard terminal with /usr/bin/login is safe since login is setuid root. Example: arctic:~> screen .. new screen session starts ... arctic:~> ls -l $TTY crw-rw-rw- 1 root wheel 4, 2 1 May 16:44 /dev/ttyp2 The fixed problem in Mac OS X now sets the devfs permissions on openpty(). ADDITIONAL INFORMATION The information has been provided by <mailto:[email protected]> Matt Johnston . ======================================== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected] ==================== ==================== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.