martin carpenter

contents

tty hijacking via tiocsti

2011/06/28

tags: solaris ioctl(2) TIOCSTI vulnerability

I have been following recent discussion on the oss-security mailing list regarding TTY hijacking via TIOCSTI ioctl at http://seclists.org/oss-sec/2011/q2/526.

This references the following bug reports:

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843
• https://bugzilla.redhat.com/show_bug.cgi?id=173008

The perl script from the debian report won't run with stock Solaris perl (cannot find sys/ioctl.ph), but this is trivial in C:

#include <unistd.h>
#include <stropts.h>
...
int insert_char_into_fd(int fd, char c) {
    return( -1 == ioctl(fd, TIOCSTI, &c) ? 0 : 1 );
}

Both Solaris 10 su(1M) and pfexec(1) are vulnerable to this problem but Oracle have marked this WONTFIX (at least for pfexec(1)) since (paraphrasing) "nobody uses pfexec to run with reduced privileges".