bugtraq - PBS Pro race condition vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 07 Jul 2010 11:36:29 +0200
From: Bartłomiej Balcerek <Bartlomiej.Balcerek@....wroc.pl>
To: bugtraq@...urityfocus.com
Subject: PBS Pro race condition vulnerability

Application:  PBS Pro (part od PBS Works by Altair Engineering)
Affected version: < 10.4
OS:  Linux/UNIX
CVE ID:   pending
Class:      temporary file creation race condition
Remote:  no
Threat:  destroy arbitrary choosen file of other user
Discovered: 02.02.2010
Discovered by: Bartlomiej Balcerek

Background:

PBS Pro is a commercial software used to perform and manage job
scheduling and execution.
It is widely used by supercomputing centers for cluster, grid and cloud
computing.

Vulnerability description:

PBS Pro execution deamon - pbs_mom - uses /var/spool/pbs/spool directory
to store
temporary files. This directory is world writable. Files within this
directory are
created on behalf of queue user (with his/her UID and GID) to store jobs
standard
output and error streams. Before pbs_mom creates a particular file, it
performs a
check whether file of that name already exists. If so, file of such name
is deleted
and than opened in write mode. It is possible to attacker to easily
guess other user
temporary file name and create arbitrary link between two actions of
check and create,
while other user job is executed. Link could point to choosen by
attacker file
owned by jobs owner, which in consequence will be overwritten by jobs
standard
output or error streams.

Exploit:

PoC attached.

Solution:

Upgrade to version >= 10.4

Bug history:

Discovered: 02.02.2010
Vendor contacted: 15.02.2010
Fixed version announced: 08.06.2010
Bug disclosed: 07.07.2010

--
Bartlomiej Balcerek

Download attachment "pbs-v10.2.0.93147-PoC.sh" of type "application/x-sh" (1626 bytes)