full-disclosure - CVE-2012-1201 Testtrack for Linux Racecondition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 20 Mar 2012 00:00:58 +0100
From: "Simon ." <bofh666ftw@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: CVE-2012-1201 Testtrack for Linux Racecondition

Software: Testtrack for Linux
Vulnerability  : Symlink
Problem type   : local
Debian-specific: dono
CVE IDs        : CVE-2012-1201
Date           : Mar 20, 2012
Affected       : min Feb 20, 2012

Problem Description:

Racecondition in Testtrack for Linux

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1201

Software:

Deliver Quality with TestTrack

TestTrack is the definitive tool suite to manage all application
development phases and artifacts. From requirements, user
stories and release planning, through sprints, assignments
and work items, to test cases, QA cycles, defect resolutions and
releases, TestTrack helps you deliver quality products on time.

[..]

Problem:

In the Linux Installation of Testtrack, there is an Init-Script
called spls, that "suffers" from a race condition.

Details:

Race in pidofproc()
splicsrv
Init file for Seapine License Server

[..]

OSNAME=`uname -s`  <-- deep into uname skills :p

[..]

   # function to find the pid of a program
   pidofproc() {
        base=`basename $1`
#       removed pidof command for awk script that parse ps output - MJT
#        pid=`pidof -o $$ -o $PPID -o %PPID -x ${base}`
        ps -ef > /tmp/ps.tbl
        pid=`awk -F" " '/\/splicsvr/ {print $2}' /tmp/ps.tbl`
        rm -rf /tmp/ps.tbl > /dev/null 2>&1
        if [ "$pid" != "" ]
        then
            echo $pid
            return 0
        fi
    }

[..]

Vendor Communication:

20 Feb -- notified.
20 Mar -- No response after 30 days -> "disclosed"

Misc Notes:

I also tried to kill arbitrary pids, but someone was so clever to match
them in /proc instead of killing them.

In the end, the sofware seems not activly maintained.

Greetings:

To CVE Team for being uncomplicated.
To pancake for being nice.
To srm, Dude! don't drink so much.
To those, who trust me.
To all who stay real.

Simon
.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/