I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a 3rd party app on my OS X box via find. According to standard practice, only critical files should be suid like chmod and passwd. My question is, how do I test this file for vulnerabilities beyond just turning it off? For example, I was able to vi the file itself and have it run a simple command but couldn't get it to chmod another user account. Does this simply mean that it was coded properly or is there a OS X function that helps secure suid vulns? Any resources, or corrections in my thoughts, would be excellent. If you know of a insecure 3rd party *nix apps or distros vulnerable to suid privilege escalation to learn on, that would be doubly excellent. Thanks.
All executables you run are "critical", as they run with your UID and have all your permissions! They could do bad things to your files, that's "critical" to me. Executables run by root are even more "critical".
It is common, but incorrect to focus on SUID files when discussing possible security flaws of a Un*x system; all executables should be considered. There are just more ways to corrupt a SUID program.
No, only executables specifically designed to run as SUID.
Writing SUID program is a whole topic, way too big to be appropriate for an answer here.
In order to do a vulnerability assessment of a program, you have to first learn what purpose it serves, how and when it should be run.
You just don't "turn off" parts of your system just because you are afraid! A program is SUID for a reason; if you remove the SUID bit, the system might misbehave.
A trusted program that can be modified by anybody is a security issue, even if it isn't SUID.
There is a long and shameful history of vulnerabilities in SUID programs. Just searching for "exploit" or "vulnerability" and "suid" returns plenty of these.
You can never prove that any system is secure. That the file is setuid and writeable by all means by definition it is a vulnerability - it doesn't matter what the file currently does / currently contains.
implies that it's a script rather than an executable - most shells have protections built into them to prevent running other scripts with the setuid identity.
But that the script is world writeable means that anyone could write some code, in say C, then overwwrite the setuid script with their own program which will run with setuid priviliege.