Ma faille préférée est celle sur l'initialisation des "services". Par défaut, en l'absence d'initialisation, on a PID=0 donc les pleins pouvoirs! Je colle le descriptif de la faille en anglais ci-dessous.
Prior to 3.0.1, the service manager (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses initialization. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized. In 3.0.1, sm returns error code 0x415 if Initialize has not been called yet.
[^] # Re: Excellente leçon de hacking
Posté par Anonyme . En réponse au journal Plongée dans les entrailles de la switch. Évalué à 6.
Ma faille préférée est celle sur l'initialisation des "services". Par défaut, en l'absence d'initialisation, on a PID=0 donc les pleins pouvoirs! Je colle le descriptif de la faille en anglais ci-dessous.
Prior to 3.0.1, the service manager (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses initialization. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized. In 3.0.1, sm returns error code 0x415 if Initialize has not been called yet.