From karl@Codebase.mcs.net  Thu Mar  6 22:05:49 1997
Received: from Kitten.mcs.com (Kitten.mcs.com [192.160.127.90])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id WAA17350
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 6 Mar 1997 22:05:48 -0800 (PST)
Received: from Codebase.mcs.net (codebase.mcs.net [192.160.127.89]) by Kitten.mcs.com (8.8.5/8.8.2) with ESMTP id AAA23577 for <FreeBSD-gnats-submit@freebsd.org>; Fri, 7 Mar 1997 00:05:47 -0600 (CST)
Received: (from root@localhost) by Codebase.mcs.net (8.8.5/8.8.2) id AAA07600; Fri, 7 Mar 1997 00:05:45 -0600 (CST)
Message-Id: <199703070605.AAA07600@Codebase.mcs.net>
Date: Fri, 7 Mar 1997 00:05:45 -0600 (CST)
From: Karl <karl@Mcs.Net>
Reply-To: karl@Mcs.Net
To: FreeBSD-gnats-submit@freebsd.org
Subject: SEVERE security bug in vfs_vnops.c
X-Send-Pr-Version: 3.2

>Number:         2906
>Category:       kern
>Synopsis:       SEVERE security bug in vfs_vnops.c
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Mar  6 22:10:03 PST 1997
>Closed-Date:    Thu Mar 6 23:22:43 PST 1997
>Last-Modified:  Thu Mar  6 23:23:40 PST 1997
>Originator:     Karl
>Release:        FreeBSD 3.0-CURRENT i386
>Organization:
MCSNet
>Environment:

	generation numbers are visible to any user for files, making 
	unauthorized modification of files on exported NFS filesystems
	easily possible.

>Description:

	see posting to freebsd-security@freebsd.org

>How-To-Repeat:

	see posting to freebsd-security@freebsd.org

>Fix:
	
*** vfs_vnops.c	Fri Mar  7 00:03:33 1997
--- vfs_vnops.c.saved	Fri Mar  7 00:03:08 1997
***************
*** 410,420 ****
  	sb->st_mtimespec = vap->va_mtime;
  	sb->st_ctimespec = vap->va_ctime;
  	sb->st_blksize = vap->va_blocksize;
!         if (suser (p->u_cred, &p->p_acflag)) {                           
!                 sb->st_gen = 0;
!         } else {                                                            
!                 sb->st_gen = vap->va_gen;                                
!         }
  	sb->st_gen = vap->va_gen;
  #if (S_BLKSIZE == 512)
  	/* Optimize this case */
--- 410,416 ----
  	sb->st_mtimespec = vap->va_mtime;
  	sb->st_ctimespec = vap->va_ctime;
  	sb->st_blksize = vap->va_blocksize;
! 	sb->st_flags = vap->va_flags;
  	sb->st_gen = vap->va_gen;
  #if (S_BLKSIZE == 512)
  	/* Optimize this case */


-- Karl Denninger
   MCSNet
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: gpalmer 
State-Changed-When: Thu Mar 6 23:22:43 PST 1997 
State-Changed-Why:  
Closed at Karls request. The patch also looks to be backwards at visual 
inspection... 
>Unformatted:
