Re: [Security-Discuss] Xine accessing /etc/passwd ????

Le Lundi 22 Mai 2006 02:16, Mark Ouellet a écrit :
> On Sun May 21 2006 02:58 pm, Michael Scherer wrote:
> > Le dimanche 21 mai 2006 à 09:36 -0400, Tuxiq a écrit :
> > > 	OK guys this is my first post so I apologize in advance for any
> > > mistakes...
> > >
> > > I noticed my latest XINE, when started from a konsole and provided with
> > > a filename on the command line, suddenly started giving me the
> > > following message when exiting ....
> > >
> > > 	mkdir(/spook) failed: Permission denied
> > >
> > > where "spook" is my normal user name. So I was curious and did an
> > > STRACE of xine which revealed that something in the process was
> > > accessing the /etc/passwd file and looking up the <root> entry !!?????
> > >
> > > IS THIS NORMAL BEHAVIOUR???????
> >
> > can you please avoid overreacting ( ie no caps, no '!!!' and '???' ) ?
>
> Sorry Michael, but who is overreacting here? I was just trying to bring
> attention to the point of the message which was, my wondering if it was
> normal behaviour.

Well, I have no problem with the question by itself, just with the form of 
final part of the question. 

> Someone once said, "it is better to let people think you are a moron, then
> to open your mouth and remove all doubts..." unfortunately this doesn't
> apply to security. Some problems can be avoided by speaking up at the risk
> of passing for a moron. I saw something that didn't make sense to me and
> spoke up. If it's normal fine, if not, someone will now hopefully be aware
> of it.
>
> > if you use strace, you will see that ls and most process actually
> > read /etc/passwd to have information like the username, the group, etc
> > etc. And so does xine.
> >
> > This is a normal behavior.
>
> Ok, but, I wasn't working as root at the time and that is the entry xine
> read from the ect/passwd, not the entry for my current user. I can
> understand reading the password file for the reason you mentionned. Which
> would mean reading the entry for "spook" in my example. But I don't
> understand why it was looking at "root" instead?

how do you know it read only the root entry ?

if this is because you have seen a line with the read syscall, then, again, 
this is normal because the whole file is read at once, but strace only show 
the beggining of what is read.

> > And, the file /etc/passwd is world readable because it no longer contain
> > anything sensitive since years.
> > The hash of the password is in /etc/shadow, as explained on almost unix
> > tutorial on the subject.
>
> Yes, thanks. I'm well aware of the shadow file. And allthough the shadow
> files have existed for a while, don't assume everyone is using an up to
> date version of their OS. I'm sure hackers don't make that assumption. In
> fact hackers make it a point to try every know trick in the book counting
> on the fact that you are NOT using the latest version and still haven't
> plugged some of the holes.

As far as i know, we are on a mandriva related list. And I never seen any 
mandriva system without shadow password. I am not even sure they started to 
use since the beggining.
 If you run xine, i strongly suspect you are running it on something newer 
than 9.0

> Sorry if I offended you with my question. I debated for a while, the pros
> and cons of posting it. My worry was that someone might simply skim the
> subjects and assume xine had some security hole in it without reading
> through.
>
> I love Xine, and jeoperdizing it is the farthest idea from my mind but the
> "mkdir" thing is new and didn't make sense to me. Why create a directory
> with the users name on the "/" <root> partition specially in the
> termination phase of the program? A badly written hack might do just that.
> Or it could just be a mistake introduced by a patched and the directory is
> part of the routine to save parameters or a playlist, etc... What ever the
> reason, someone needed to be made aware of it either to correct a bug or
> fix a security risk. Better safe than sorry.

if you think this is a bug, then, bugzilla is the tool to use.

what version of xine ( rpm -q xine-ui ), do you reproduce it on other 
computer ?

I see this on cooker as well, but i do not think this is a security problem.

And, from what i see, xine in cooker is not patched, so this is likely a 
problem in xine code than a patched version or a hack.

You should report it to xine developers, and see if this was not already 
referenced in their bugs database, if they have one.

-- 
Michael Scherer
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________