World-writable files installed by ports
Kris Kennaway
kris at obsecurity.org
Fri Sep 1 01:27:17 UTC 2006
On Thu, Aug 31, 2006 at 10:19:24AM -0400, Kris Kennaway wrote:
> On Thu, Aug 31, 2006 at 06:15:18PM +0400, Andrew Pantyukhin wrote:
> > Under no circumstances should a port install world-writable
> > files or directories. In most cases this opens the system to all
> > kinds of attacks. A simple grep brings the following list of
> > makefiles to attention. I imagine that samba ports are
> > somehow justified, as for the other ones, I hope secteam and
> > committers will do something about them.
>
> The install process will warn about this (as well as group writable),
> so you can also grep for the warning message in the pointyhat logs.
Here's the list of world-writable from the last i386 6.x build:
./xphotohunter-1.4_2.log.bz2: This port has installed the following world-writable files/directories.
./xphotohunter-1.4_2.log.bz2-/usr/X11R6/share/xphotohunter/xphotohunter.dat
./xphotohunter-1.4_2.log.bz2-
--
./xrally-1.1.1_2.log.bz2: This port has installed the following world-writable files/directories.
./xrally-1.1.1_2.log.bz2-/usr/local/share/xrally/hiscore
./xrally-1.1.1_2.log.bz2-
--
./childsplay-0.80.2_1.log.bz2: This port has installed the following world-writable files/directories.
./childsplay-0.80.2_1.log.bz2-/var/games/childsplay.score
./childsplay-0.80.2_1.log.bz2-
--
./dislin-9.0_2.log.bz2: This port has installed the following world-writable files/directories.
./dislin-9.0_2.log.bz2-/usr/local/dislin/dislin.log
./dislin-9.0_2.log.bz2-
--
./fr-facturier-2.1.2.log.bz2: This port has installed the following world-writable files/directories.
./fr-facturier-2.1.2.log.bz2-/usr/local/www/facturier/log/debug1.txt
./fr-facturier-2.1.2.log.bz2-/usr/local/www/facturier/log/debug.txt
./fr-facturier-2.1.2.log.bz2-
--
./admuser-2.3.1_2.log.bz2: This port has installed the following world-writable files/directories.
./admuser-2.3.1_2.log.bz2-/usr/local/etc/admuser/admuser.log
./admuser-2.3.1_2.log.bz2-
--
./tornado-1.3_1.log.bz2: This port has installed the following world-writable files/directories.
./tornado-1.3_1.log.bz2-/usr/local/share/games/tornado.scores
./tornado-1.3_1.log.bz2-
--
./atris-1.0.7.log.bz2: This port has installed the following world-writable files/directories.
./atris-1.0.7.log.bz2-/usr/local/share/atris/Atris.Players
./atris-1.0.7.log.bz2-/usr/local/share/atris/Atris.Scores
./atris-1.0.7.log.bz2-
--
./pips900-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips900-2.1.2_2.log.bz2-/usr/local/etc/pipsrc
./pips900-2.1.2_2.log.bz2-
--
./pips880-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips880-2.1.2_2.log.bz2-/usr/local/etc/pipsrc
./pips880-2.1.2_2.log.bz2-
--
./pips-scx3500_3600s-2.6.2_1.log.bz2: This port has installed the following world-writable files/directories.
./pips-scx3500_3600s-2.6.2_1.log.bz2-/usr/local/etc/pipsrc
./pips-scx3500_3600s-2.6.2_1.log.bz2-
--
./pips-sc65_66s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-sc65_66s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-sc65_66s-2.6.2_2.log.bz2-
--
./pips-sp2100_2200-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-sp2100_2200-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-sp2100_2200-2.6.2_2.log.bz2-
--
./pips-spr200_210-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-spr200_210-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-spr200_210-2.6.2_2.log.bz2-
--
./pips-sc84_83s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-sc84_83s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-sc84_83s-2.6.2_2.log.bz2-
--
./pipsg700-2.6.2_3.log.bz2: This port has installed the following world-writable files/directories.
./pipsg700-2.6.2_3.log.bz2-/usr/local/etc/pipsrc
./pipsg700-2.6.2_3.log.bz2-
--
./pips980-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips980-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips980-2.6.2_2.log.bz2-
--
./pipsv600-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pipsv600-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pipsv600-2.6.2_2.log.bz2-
--
./pips940-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips940-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips940-2.6.2_2.log.bz2-
--
./pipsg800-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pipsg800-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pipsg800-2.6.2_2.log.bz2-
--
./xgalaga-2.0.34_1.log.bz2: This port has installed the following world-writable files/directories.
./xgalaga-2.0.34_1.log.bz2-/usr/X11R6/lib/X11/xgalaga/scores
./xgalaga-2.0.34_1.log.bz2-
--
./xpuzzletama-1.5b.log.bz2: This port has installed the following world-writable files/directories.
./xpuzzletama-1.5b.log.bz2-/usr/X11R6/lib/X11/xpuzzletama/tama_score
./xpuzzletama-1.5b.log.bz2-
--
./pips-sc85_86s-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-sc85_86s-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-sc85_86s-2.6.2_2.log.bz2-
--
./pipsv500-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pipsv500-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pipsv500-2.6.2_2.log.bz2-
--
./spacearyarya-1.0.2_1.log.bz2: This port has installed the following world-writable files/directories.
./spacearyarya-1.0.2_1.log.bz2-/usr/X11R6/share/SpaceAryarya/data/.score
./spacearyarya-1.0.2_1.log.bz2-
--
./pipsg900-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pipsg900-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pipsg900-2.6.2_2.log.bz2-
--
./pips-spr300_310-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-spr300_310-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-spr300_310-2.6.2_2.log.bz2-
--
./xsok-1.02.log.bz2: This port has installed the following world-writable files/directories.
./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Sokoban.score
./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Xsok.score
./xsok-1.02.log.bz2-/usr/X11R6/lib/X11/xsok/Cyberbox.score
./xsok-1.02.log.bz2-
--
./xgs-0.50_1.log.bz2: This port has installed the following world-writable files/directories.
./xgs-0.50_1.log.bz2-/usr/local/share/xgs/xgs.ram
./xgs-0.50_1.log.bz2-
--
./xmines-1.0.log.bz2: This port has installed the following world-writable files/directories.
./xmines-1.0.log.bz2-/usr/X11R6/share/xmines/scores
./xmines-1.0.log.bz2-
--
./glest-data-2.0.0.log.bz2: This port has installed the following world-writable files/directories.
./glest-data-2.0.0.log.bz2-/usr/X11R6/lib/glest/glest.log
./glest-data-2.0.0.log.bz2-
--
./xwelltris-1.0.1.log.bz2: This port has installed the following world-writable files/directories.
./xwelltris-1.0.1.log.bz2-/usr/local/share/xwelltris/welltris.scores
./xwelltris-1.0.1.log.bz2-
--
./pips4000-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips4000-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips4000-2.6.2_2.log.bz2-
--
./pips780-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips780-2.1.2_2.log.bz2-/usr/local/etc/pipsrc
./pips780-2.1.2_2.log.bz2-
--
./pips820-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips820-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips820-1.3.2_2.log.bz2-
--
./pipsv700-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pipsv700-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pipsv700-2.6.2_2.log.bz2-
--
./grande-0.6_2.log.bz2: This port has installed the following world-writable files/directories.
./grande-0.6_2.log.bz2-/usr/X11R6/share/grande/score/grande.scores
./grande-0.6_2.log.bz2-
--
./pips-sc60s-2.5.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-sc60s-2.5.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-sc60s-2.5.2_2.log.bz2-
--
./pips800-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips800-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips800-1.3.2_2.log.bz2-
--
./xbill-2.1_2.log.bz2: This port has installed the following world-writable files/directories.
./xbill-2.1_2.log.bz2-/usr/X11R6/share/xbill/scores/xbill/scores
./xbill-2.1_2.log.bz2-
--
./pips-sc80s-2.5.2_1.log.bz2: This port has installed the following world-writable files/directories.
./pips-sc80s-2.5.2_1.log.bz2-/usr/local/etc/pipsrc
./pips-sc80s-2.5.2_1.log.bz2-
--
./pips760-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips760-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips760-1.3.2_2.log.bz2-
--
./pips730-2.5.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips730-2.5.2_2.log.bz2-/usr/local/etc/pipsrc
./pips730-2.5.2_2.log.bz2-
--
./pips870-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips870-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips870-2.6.2_2.log.bz2-
--
./pips3300-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips3300-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips3300-1.3.2_2.log.bz2-
--
./pips3500-2.1.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips3500-2.1.2_2.log.bz2-/usr/local/etc/pipsrc
./pips3500-2.1.2_2.log.bz2-
--
./pips930-2.6.2_1.log.bz2: This port has installed the following world-writable files/directories.
./pips930-2.6.2_1.log.bz2-/usr/local/etc/pipsrc
./pips930-2.6.2_1.log.bz2-
--
./pips970-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips970-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips970-2.6.2_2.log.bz2-
--
./pips750_2000-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips750_2000-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips750_2000-1.3.2_2.log.bz2-
--
./columns-1.2b_1.log.bz2: This port has installed the following world-writable files/directories.
./columns-1.2b_1.log.bz2-/usr/X11R6/share/Columns/columns.hsc
./columns-1.2b_1.log.bz2-
--
./pcemu-1.01b_1.log.bz2: This port has installed the following world-writable files/directories.
./pcemu-1.01b_1.log.bz2-/usr/local/lib/pcemu/DriveA
./pcemu-1.01b_1.log.bz2-
--
./xjewel-1.6.log.bz2: This port has installed the following world-writable files/directories.
./xjewel-1.6.log.bz2-/usr/X11R6/lib/X11/xjewel/xjewel.scores
./xjewel-1.6.log.bz2-
--
./geki2-2.0.3.log.bz2: This port has installed the following world-writable files/directories.
./geki2-2.0.3.log.bz2-/usr/local/share/geki2/data/.score
./geki2-2.0.3.log.bz2-
--
./AutoIndex-2.2.0.log.bz2: This port has installed the following world-writable files/directories.
./AutoIndex-2.2.0.log.bz2-/usr/local/www/data/AutoIndex/config.php
./AutoIndex-2.2.0.log.bz2-
--
./geki3-1.0.3.log.bz2: This port has installed the following world-writable files/directories.
./geki3-1.0.3.log.bz2-/usr/local/share/geki3/data/.score
./geki3-1.0.3.log.bz2-
--
./oilwar-1.2.1_3.log.bz2: This port has installed the following world-writable files/directories.
./oilwar-1.2.1_3.log.bz2-/usr/local/share/oilwar/oilwar.scores
./oilwar-1.2.1_3.log.bz2-
--
./linux_base-gentoo-stage3-2006.0_1.log.bz2: This port has installed the following world-writable files/directories.
./linux_base-gentoo-stage3-2006.0_1.log.bz2-/compat/linux/lib/udev/devices/null
./linux_base-gentoo-stage3-2006.0_1.log.bz2-/compat/linux/lib/udev/devices/zero
./linux_base-gentoo-stage3-2006.0_1.log.bz2-
--
./linux_dist-gentoo-stage3-2006.0_1.log.bz2: This port has installed the following world-writable files/directories.
./linux_dist-gentoo-stage3-2006.0_1.log.bz2-/usr/local/gentoo-stage3/lib/udev/devices/null
./linux_dist-gentoo-stage3-2006.0_1.log.bz2-/usr/local/gentoo-stage3/lib/udev/devices/zero
./linux_dist-gentoo-stage3-2006.0_1.log.bz2-
--
./pips670-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips670-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips670-1.3.2_2.log.bz2-
--
./pips770-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips770-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips770-1.3.2_2.log.bz2-
--
./phpGedView-3.2.1_1.log.bz2: This port has installed the following world-writable files/directories.
./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config_download.php-dist
./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config_gedcom.php-dist
./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/authentication_mysql.php-dist
./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/authentication_index.php-dist
./phpGedView-3.2.1_1.log.bz2-/usr/local/www/data/phpGedView/config.php-dist
--
./pips2200-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips2200-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips2200-1.3.2_2.log.bz2-
--
./pips740-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips740-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips740-2.6.2_2.log.bz2-
--
./inform-6.30.log.bz2: This port has installed the following world-writable files/directories.
./inform-6.30.log.bz2-/usr/local/share/doc/inform/readme.txt
./inform-6.30.log.bz2-
--
./pips3000-1.3.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips3000-1.3.2_2.log.bz2-/usr/local/etc/pipsrc
./pips3000-1.3.2_2.log.bz2-
--
./fr-gibi-2003.2.log.bz2: This port has installed the following world-writable files/directories.
./fr-gibi-2003.2.log.bz2-/usr/local/apps/gibi/USRDAT
./fr-gibi-2003.2.log.bz2-
--
./pips-spr800-2.6.2_2.log.bz2: This port has installed the following world-writable files/directories.
./pips-spr800-2.6.2_2.log.bz2-/usr/local/etc/pipsrc
./pips-spr800-2.6.2_2.log.bz2-
Kris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-ports/attachments/20060901/7b2f643b/attachment.pgp
More information about the freebsd-ports
mailing list