[hobbit-announce] Hobbit monitor: Security issue with Hobbit 4.2-beta client

[Asif Iqbal]

On Fri, Jun 30, 2006 at 06:47:25PM, Henrik Storner wrote:
> 
> I was just notified by a Hobbit user that the current beta client has
> a security problem in the client "logfetch" utility, when installed as
> suid-root (which is the default if "make install" is executed as root).
> 
> 
> Impact
> ------
> The effect of this is that any user who is able to login and create
> files on a system with the Hobbit client installed, can use the "logfetch" 
> utility to get read access to any file on the system.
> 
> 
> Which versions are affected
> ---------------------------
> This issue affects all of the pre-release (alfa-, beta- and snapshot-versions) 
> of the Hobbit client version 4.2 released until today (2006-Jun-30), when the 
> client was installed as root and ~hobbit/client/bin/logfetch is suid-root.
> 
> The 4.1.x releases of the Hobbit client does not include the "logfetch"
> utility, and are therefore NOT affected by this.
> 
> 
> Remedy
> ------
> It is recommended that you remove the suid bit from the logfetch utility
> on systems where you have installed the Hobbit 4.2-beta client package.
> 
> To do this:
>      chmod 755 ~hobbit/client/bin/logfetch
> 
> Note that this may cause logfile monitoring to break, if the client does
> not have read access to the monitored logfiles.

For our systems we make sure if a log file needs to be monitored, 
it is atleast readable by a group in which `hobbit' user belongs to.

> 
> Running logfetch as suid-root will most likely be removed in the final 
> Hobbit 4.2 release of the client.

I like that

> 
> 
> Regards,
> 
> Henrik Storner, the Hobbit developer
> 

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
"..there are two kinds of people: those who work and those who take the credit...try
 to be in the first group;...less competition there."  - Indira Gandhi