Title: Linux Non-Readable File Ptrace Vulnerability
Severity: INFO
Description:
Ptrace is a unix system call that is used to analyze running processes, usually for breakpoint debugging. The linux implementation of ptrace in 2.2.x kernels (and possibly earlier versions) contains a vulnerability that may allow an attacker to gain sensitive information in non-readable non-setuid executable files.
For security reasons, regular users are not allowed to ptrace setuid programs (or attach to processes running as another uid) nor are they allowed to trace processes originating from un-readable disk images (binary files). These restrictions are properly enforced in Linux ptrace when using PT_ATTACH to trace aribtrary non-children processes in memory.
When ptrace is called to trace a child process however, it does not properly check to make sure that the disk image is readable to the user. As a result, the process can be traced and its core memory examined. Information compiled into the binary that was meant to be hidden via setting it non-readable may be disclosed to an attacker.
The information obtained could be used to assist in other attacks.
Affected Products:
- Caldera OpenLinux 2.3.0
- Linux kernel 2.2.10
- Linux kernel 2.2.12
- Linux kernel 2.2.13
- Linux kernel 2.2.14
- Linux kernel 2.2.15
- Linux kernel 2.2.16
- Linux kernel 2.2.17
- MandrakeSoft Corporate Server 1.0.1
- MandrakeSoft Linux Mandrake 7.1.0
- MandrakeSoft Linux Mandrake 7.2.0
- RedHat Linux 6.2.0
- RedHat Linux 7.0.0
- S.u.S.E. Linux 6.3.0
- S.u.S.E. Linux 6.4.0
- S.u.S.E. Linux 7.0.0
- SCO eDesktop 2.4.0
- SCO eServer 2.3.1
- Sun Cobalt Qube 3
- Sun Cobalt RaQ 4
- Sun Cobalt RaQ XTR
- Trustix Secure Linux 1.1.0
- Trustix Secure Linux 1.2.0
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
