.Sequence vulnerability - Re: flexfax: faxgetty and internet simultaneously

• Messages sorted by:[ date ][ thread ][ subject ][ author ]

On Fri, Aug 13, 1999 at 08:01:42AM +0200, Gert Doering wrote:
> Hi,
> 
> On Fri, Aug 13, 1999 at 07:02:16AM +0200, Mirek Kwasniak wrote:
> > > > Kernel 2.2.10-ac12 (in Alan Cox series) gives us problem with sending faxes
> > > > (faxspool don't work for differnt users). You need patch for ext2fs/inode.c
> > > > (from kernel mailing list).
> > > Huh.  Now this sounds like a real nasty bug in the kernel - faxspool
> > > doesn't really do any "bad" or "nonportable" stuff...
> > Yes, faxspool doesn't "nonportable" stuff, but writable (at least for group)
> > /var/spool/fax/outgoing/.Sequence isn't proof solution, any can exploit it :(
> 
> Exploit it to do *what*?  On a Unix system, there are always ways to annoy
> other people (corrupting .Sequence, ...
                ^^^^^^^^^^^^^^^^^^^^^

Yes this is a problem. I don't think about gaining root priviledges but about
DoS (deny of service) attack.

> filling up /tmp, allocating too much
  ^^^^^^^^^^^^^^^        
file system quota your frend :)

> memory and CPU), so what's the point?  You can't get root that way.
^^^^^^^^^^^^^^^^^

per user limits

> 
> Anyway, I don't understand what this point has anything to do with Alan's
> 2.2.10-ac12 kernel and the required patch?

Exploration 2.2.10-ac12 kernel problem gives me info about .Sequence DoS
vulnerability.

Mirek