IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.20 Abuse of Administrator rights
Abuse of Administrator rights occurs when superuser (root) privileges,
acquired either rightfully or illicitly, are deliberately used to harm the system
or its users.
Example:
Since root in UNIX systems is not subject to any restrictions, the
Administrator is able to read, modify or delete any file, regardless of access
rights. Moreover, he can assume the identity of any user of his system, without
this fact being perceived by any other user; thus, it is possible for him, by
feigning another person's identity, to send mail messages or to read and/or
delete mail messages intended for others.
There are a number of ways in which superuser privileges can be abused.
These include misuse of incorrectly administered superuser files (files with
root as owner and s-bit set) and of the su command.
Automatic mounting of exchangeable data media can also constitute a threat,
since as soon as the medium is placed in the drive, it is mounted. Then
anybody has access to the files stored there. If any s-bit programs are stored
on the mounted drive, any user can obtain superuser rights.
Depending on the UNIX version and the hardware used, if the console can be
accessed then it is possible to activate monitor mode or else to boot up in
single-user mode. This allows the configuration to be manipulated.
A software error could mean that a given application is only able to process a
limited amount of data. If too much data or too many parameters are passed to
this application, areas of main memory could be overwritten with alien code.
This could result in commands being executed with the rights of the
application. This was possible, for example, under SunOS 5.5 with the
command eject, which possessed SetUID rights which to all intents and
purposes were equivalent to superuser rights.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
No restrictions for root
Superuser files
Automatic mounting
Access to the console
Software errors