search

btbars / unix-privesc-check

Automatically exported from code.google.com/p/unix-privesc-check
0 stars 0 forks source link

world_can_read () check for writeable bit and not for readable bit #39

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago 
Download unix-privsec-check version 1.4 and open the file with an editor.
Go to the line 498. 
-----------------------
world_can_read () {
    O_MESSAGE_STACK=$1
    O_FILE=$2

    P=`ls -lLd $O_FILE | cut -c 8`

    if [ "$P" = "w" ]; then
        echo "WARNING: $O_MESSAGE_STACK World read is set for $O_FILE"
    fi
}
------------
The world_can_read function check for the bit 'w' and not the bit 'r'. 
This is wrong, because in this function we are checking for world readable and 
not world writeable files or directories. 

Regards, 
R.
--
Roberto Martelloni \ boos
http://boos.core-dumped.info

Original issue reported on code.google.com by rmartell...@gmail.com on 21 Mar 2014 at 10:27