Re: Insecurities in Non-exclusive Scoket Binding

Firosh Ummer wrote:
>>Socket hijacking itself is not new - it has been cited in several sources

>>on the net. What I find disturbing is how easy it is for an attacker to

>This is an old, old story. I remember reading many years ago about this

This is true. In fact, I wrote a proof-of-concept NFS server in 1996 for this. It simply took over port 2049 for a brief period, and sent a setuid-root copy of /bin/sh over to the client system. Of course it wouldn't work if it was mounted nosuid, but in other cases, anyone executing the shell on the client that had a mounted filesystem from the server running the fake NFS server would become root.

Oliver Friedrichs
Sr. Manager - DeepSight
Symantec, Inc. Received on Tue Mar 11 12:06:22 2003