Hi,

if I create a tarball at my Linux at home, containing an executable with root as owner and the sticky bit set, then I still can login to a different Linux, where I don't have root permissions, and extract that executable using the p switch. That will preserve the root owner and the sticky bit, so that I gain control over that Linux.

Kind regards
Heiner

Comment Removed By Poster

Heiner, the only way for untared files to have root ownership is if you have root privilages when you untar them. BTW, if you were able to have root-owned files when untaring them as a non-root user, that would be an operating system vulnerability, not a tar one.

You're obviously new here. Please read the LQ Rules because you border on violating the LQ Rules: "Posts containing information about cracking, piracy, warez, fraud or any topic that could be damaging to either LinuxQuestions.org or any third party will be immediately removed." Feel free to contact me if you don't understand the LQ Rules.

Hi,

I am aware that the information, that I posted, can be used to crack a system. I intendedly posted in the security forum. But I want to help making software more secure. Sometimes it is necessary to talk about a vulnerability before someone else uses such a vulnerability when he has found out and not shared his knowledge. I want to give the OS programmers and the tar programmers a chance to think about the security of the p option.

kind regards
Heiner

Cracking information is not allowed on ANY of the LQ forums.

If you find a security vulnerability in a program, the ethical first thing to do is to contact the developer in private - not go and post it on a public website. There is actually a de-facto standard order of steps to take in these cases, and it goes something like: 1) Notify developer. 2) Notify users. 3) Notify public. Google for vulnerability disclosure guidelines if you want details.

As a side note, I hope that by now you understand that something is definitely not right in your setup, and the "vulnerability" you are refering to might just mean that something is broken on your box. Or perhaps you haven't even tried to do it yet but you imagine it would work this way. I don't know. All I can tell you is that non-root users will not be able to have files untar with root permissions no matter how many sticky bits were set.

Having said that, I'm closing this thread because even though the vulnerability you speak of seems imaginary to me, the intention behind your post (to share information about what you believe really is a crack) is very real and it is not compatible with the LQ Rules, as has already been mentioned by unSpawn. Don't ever make these type of posts again - consider this an official warning.