BSD tty security, part 4: What You Can Look Forward To

[Jeff d'Arcy]

Paul-Pomes at uiuc.edu:
> From: ian at pharaoh.UUCP (Ian Crocker)
>
>>Further to my previous post I thought of a machine I hadn't tried it on and 
>>sure enough it worked.  Complete control of the root terminal from an
>>unprivileged userid.  Seems this manufacturer is lagging behind the others -
>>no prizes for guessing who it is!
>
>Sequoia Systems?  After all, they're too busy to check.

This post gave me the incentive to check things out under TOPIX (Sequoia's
UNIX-compatible OS) despite the fact that I'll probably get in trouble for
taking the time away from my assigned tasks to do so.  What I found was a
very serious security bug involving TIOCSTI, but I don't think it's the same
one people have been talking about here.  It doesn't bother me to admit that
the problem exists because:

	(a) I've barely been at Sequoia long enough to remember my boss's
	name, let alone take responsibility for day-one bugs; and

	(b) the existence of the problem in TOPIX does nothing to invalidate
	any of my earlier statements.

Now it's on my list of things to fix.  Big deal.  Except for the publicity,
there's nothing to distinguish this bug from the sort of stuff that I and
thousands of other OS developers at dozens of companies have seen every day
for years.  Maybe Dan, Ian, and Paul's excitement can be explained by the
observation that just about anything is exciting the first few times.

Believe me, kids: there are dozens of bugs in *every OS in the world* that
would horrify users and administrators alike if they were ever made known.
Twiddle this, frobnicate that, and...BLAM...instant super-user, or system
crash, or filesystem corruption, or whatever.  Should I tell you about the
SOCK_RAW crashes at one vendor, or the disappearing disk space at another,
or the setuid bug at a third?  Really, I got a million of 'em.  Why don't
you guys stop crowing because you found *one* bug in *one* OS, and think a
little about how many you *don't* know about and never will?  I'm sure there
are plenty of scary bugs that I'll never hear about because they were fixed
by my predecessors.

Excuse me.  I have bugs to fix.
-- 

Jeff d'Arcy, Generic MTS, Sequoia Systems Inc. <jdarcy%seqp4 at m2c.org>
         Time flies like an arrow; fruit flies like a banana