topic Re: Can .forward execute code? in Operating System - HP-UX

Can .forward execute code?

Daniel M. Gonzales — Mon, 10 Jul 2006 09:56:43 GMT

Working on a security cleanup assignment. Heard mention that the UNIX .forward file can be used to execute code, acting like a back door. Does anyone know if this applies to HP-UX?

Re: Can .forward execute code?

Steven E. Protter — Mon, 10 Jul 2006 09:58:59 GMT

Shalom,

It does not execute code.

It can forward a users mail from his/her home directory to anywhere and can be used maliciously to relay spam. It should have tight permissions on it if it exists at all.

It certainly should not have execute rights, or it could be modified to be a shell script that does execute code.

It is much better to handle sendmail forwarding in the /etc/aliases file or in virtusertables genericstables which are controlled and owned by root.

SEP

Re: Can .forward execute code?

James R. Ferguson — Mon, 10 Jul 2006 09:59:59 GMT

Hi Daniel:

The potential relates to the '.forward' file for UNIX in general.

Regards!

...JRF...

Re: Can .forward execute code?

Bill Hassell — Mon, 10 Jul 2006 15:09:49 GMT

The file /etc/mail/aliases and .forward have similar capabilities. The .forward file itself does not execute but it may contain directives such as: pipe mail to this script, and is exactly how you can filter or process email automatically as it is received. It's not exactly a backdoor since /etc/mail/aliases is owned by root and not writable by ordinary users. A user can place a .forward in their $HOME directory but the script will only run if the delivery process can run the script or program. This is likely where a security scan would be centered:

ll /home/*/.forward

If you grep for the | (pipe) symbol in aliases and .forward files, you will see any automated mail handling. Also look for procmail as another way to handle incoming email.

Re: Can .forward execute code?

Ron Cohen — Fri, 14 Jul 2006 08:08:49 GMT

yes. you can use .forward to invoke commands via pipes. once encountered a user which use this future to invoke backdoor by sending mail with a triggering word.