[VulnDiscuss] Re: SRT2003-06-12-0853 - ike-scan local root format string issue

KF <[email protected]> writes:

> In a default configuration ike-scan is not suid root. The suid bit is
> not set during the install. As an admin you may have been tricked by a 
> user that was perhaps higher on the food chain than you and he really 
> wanted to use ike-scan so you had to chmod +s /usr/local/bin/ike-scan
> for him. In other words there is potential for this to be exploited. 

I find it hard to believe that this is a problem.  Setting the
SUID/SGID flag on random applications is a sure way to a system
compromise by untrusted local users.  This is an administration error,
not a problem of ike-scan (unless it explicitly claims that it's
SUID/SGID-safe, which isn't the case AFAIK).

By the way, ike-scan contains code "phone home" and track its
spreading.

/*
 *      If we're not reading from a file, then we must have some hosts
 *      given as command line arguments.
 */
   hp = gethostbyname("ike-scan-target.test.nta-monitor.com");
   if (!filename_flag) 
      if ((argc - optind) < 1)
         usage();

Maybe there are other goodies hidden in the code. 8-(

-- 
Florian Weimer 	                  [email protected]
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898