Subject: Re: SITE_EXEC programs as root?

From: [email-masked] (Stan Barber)
Date: Sat, 2 Sep 1995 00:08:11 CDT

Thanks for the note. I will be working to get beta 6 out over the Labor
day weekend (this weekend for those of you outside the US) and stomping
all the bugs reported so far.

-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: amdahl!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

---

From: Yanming PENG <[email-masked]>
Date: Sun, 3 Sep 95 14:06:11 WETDST

> 
> On Fri, 1 Sep 1995, Chadwick A. Dubuque wrote:
> 
> This is a bug in wu.ftpd if you issue the command

To be precise, it is not a bug in the wu.ftpd. It was misconfigured
in many binaries distributions (_PATH_EXECPATH in src/pathnames.h)

> ftp> SITE EXEC "/bin/bash -c id"
> it will show you eid 0, which is a security risk, whereby anyone can do work
> as root! there is a ver. which has this corrected (I don't remeber which 
> ver.), also I think there's a way to disable SITE EXEC
> 
Recompile it with:
#define _PATH_EXECPATH  "/bin/ftp-exec"

You get the option to disable SITE EXEC by leaving /bin/ftp-exec empty,
or putting whatever you think is necessary.

--
Yanming PENG
[email-masked]

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Tue, 12 Sep 1995 10:27:10 -0500 (CDT)

I wrote the following a long time ago:

> I'm trying to get users to be able to execute a SITE EXEC quota -v, but
[...]

SITE_EXEC programs are being run UID=0 and EUID=(ftp user's UID).

> This is using 2.4.2 ACADEM BETA 5.

Since no one's yet said they're working on it or offered a patch, and I need
to fix this before I can put users on the machine, I've decided to take a
crack at it. Unfortunately, I seem to have aquired an illness making it very
difficult to think, so please forgive any lapses in logic or
comprehensibility.

One of the problems that I've discovered while pondering how to fix this
problem is that BSD/SYS_V UID implementations of UIDs, and therefore
setuid(), differ. This topic is currently being discussed on the newsgroup
comp.unix.wizards.

The problem is that setuid() wants to keep a copy of the uid it was called
as so it can later change back. And, BSD and SYS_V do this in different ways.

It appears that there will have to be a call to setuid() in popen.c. I'm
just not sure how to get the "real user"'s ID down there, and if I do
setuid() the new process, will it be able to jump back via some saved UID?

Any help?

NOTE THAT I DON'T NEED TO KNOW HOW TO DISABLE SITE EXEC. :-)
Instead, I need to know how to *fix* it. Thank you.

-- 
Chadwick A. Dubuque            [email-masked]
http://www.acm.ndsu.NoDak.edu/~cdubuque/   finger for PGP pub. key 
postal:USA/58105-5164/ND/Fargo/IACC 258 NDSU Box 5164/Chad Dubuque