I just sent this to bugtraq, and I thought It might be of interest here.
Any DEC people care to comment?
---------- Forwarded message ----------
Date: Tue, 29 Apr 1997 15:06:50 -0400 (EDT)
From: Tom Leffingwell <tom_at_sba.miami.edu>
To: bugtraq_at_netspace.org
Subject: Digital UNIX/Irix mesg problem
This is rather stupid and not much of a bug, but it shouldn't
happen. Basically, the permissions on your tty are set correctly, with
messages on, during login. If you turn them off, and then turn them back
on, your tty becomes world writable. (Actually, you don't have to turn
them off, mesg y automatically sets permissions that way). I don't
remember that being that way in Digital UNIX 3, but I can't think of a box
to check it on. I noticed that Ultrix, FreeBSD, and Solaris don't have
this problem. I also noticed that Irix does the same thing (has the
problem). I did call DEC, but they seemed rather confused. I don't see
any reason for this. Nothing to exploit, but I guess people could easily
fake a write from another user, or send annoying things anonymously
(cat /vmunix > /dev/ttyXX).
% tty
/dev/ttyp4
% ls -l /dev/ttyp4
crw--w---- 2 tom terminal 6, 4 Apr 29 14:50 /dev/ttyp4
% mesg n
% ls -l /dev/ttyp4
crw------- 2 tom terminal 6, 4 Apr 29 14:50 /dev/ttyp4
% mesg y
% ls -l /dev/ttyp4
crw--w--w- 2 tom terminal 6, 4 Apr 29 14:50 /dev/ttyp4
____________________________________________________________________
Tom Leffingwell Office: Jenkins 314K
Systems Manager Office Phone: (305) 284-1962
Network Security Email: tom_at_sba.miami.edu
School of Business
University of Miami
____________________________________________________________________
Received on Tue Apr 29 1997 - 21:21:33 NZST