bugtraq - Local root exploit in SuSE Linux 7.3Pro

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 6 Oct 2003 15:06:57 +0200
From: Stefan Nordhausen <deletethis.nordhaus@...ormatik.hu-berlin.de>
To: bugtraq@...urityfocus.com
Subject: Local root exploit in SuSE Linux 7.3Pro

Affected:               SuSE Linux 7.3Pro
Not affected:           SuSE Linux 8.2Pro, non-SuSE distributions
Possibly affected:      other SuSE distributions
Vulnerable package:     javarunt

Impact:                 Local user can gain root privileges
Exploit type:           Symlink attack
Release date:           October 6th 2003
Vendor status:          SuSE was contacted on September 4th (> 1 month ago).
                        No SuSE-patch yet.

A symlink vulnerability exists in the shell script 
/sbin/conf.d/SuSEconfig.javarunt. This file is part of the package "javarunt" 
(Java runtime environment).

This vulnerability can be used by a local attacker to gain root privileges. An 
exploit has already been written by me, but I will not release it before 
October 20th.

Workaround:
As there is no SuSE patch available yet, you will have to fix this yourself. 
You can use the following quick'n'dirty patch to fix the issue. Note however 
that I am NOT responsible if you mess up your system! You should know what 
you're doing!

In the mentioned script you should replace _every_ occurrence of

/tmp/.java_wrapper

with the following:

/root/.java_wrapper.$$

Again, this is not pretty but it should work.

This advisory, contact information and the exploit can be found at 
http://www.hu-berlin.de/~nordhaus/sec/vul/index.html

--
Beware of he, who would deny you access to information. For in his heart, he 
dreams himself your master.