lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 18 Jun 2018 13:24:23 +0300 (EEST)
From: Harry Sintonen <>
Subject: [FD] MagniComp SysInfo Information Exposure [CVE-2018-7268]

MagniComp SysInfo Information Exposure [CVE-2018-7268]
The latest version of this advisory is available at:


MagniComp SysInfo contains a information exposure vulnerability through debug


Due to a combination of setuid binary and verbose debugging, MagniComp SysInfo can be
used to read any file on the system owned by root (uid 0).


A local unprivileged user is able to read any root (uid 0) owned file on the system,
regardless of the file permissions. Confidential information such as password hashes
(/etc/shadow) or other secrets (such as log files, private keys) can be leaked to
the attacker. The vulnerability has a confidentiality impact, but has no direct impact
on system integrity or availability.


The discovered vulnerabilities, described in more detail below, enable the attack
described here in brief.

1. A local attacker executes the following command to obtain access to /etc/shadow:
$ /opt/sysinfo/bin/sysinfo --licensevalid /etc/shadow --debug 2>&1 | grep PARSE:
2. The attacker performs further attacks on the exposed password hashes

The attacker is able to use the vulnerability to expose other confidential
information, too, such as private keys, configuration and log files.


1. CWE-215: Information Exposure Through Debug Information [CVE-2018-7268]

The SysInfo mcsiwrapper is installed setuid root. The --licensevalid option reads
the license file, parses it and returns validity status of the license. Due to an
oversight enabling debug output with --debug also outputs the contents of the file to
the stderr while performing the parsing, exposing the file contents in the process.

The vulnerability can only be used to read files owned by root (uid 0). An attempt
to read a file owned by someone else is met with the following error:

"mcsiwrapper: CERROR: Option --licensefile is unsafe: "/home/user/foo" REASON: Path
  must be owned by uid 0 or uid 0 when running setuid: path owned by uid 1000."

Vulnerable versions

The following SysInfo versions are confirmed vulnerable:

- Linux/Unix/Mac SysInfo versions up and including 10.0 (H80)

Notably MagniComp SysInfo is bundled with the BMC BladeLogic Automation product. With
BMC BladeLogic installations the tool can be found from the following location:


1. Upgrade to SysInfo 10-H81 or later

Similar or prior work

1. Unrelated earlier privilege escalation vulnerability CVE-2017-6516 -


The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.


2018.02.13  discovered the vulnerability
2018.02.14  wrote a preliminary advisory
2018.02.14  contacted MagniComp at requesting security contact
2018.02.14  sent vulnerability details to CERT-FI vulncoord
2018.02.15  sent vulnerability details to MagniComp security contact
2018.02.16  MagniComp acknowledged the vulnerability
2018.02.20  requested CVE ID from MITRE
2018.02.21  CVE-2018-7268 assigned by MITRE
2018.02.22  MagniComp released SysInfo 10-H81 fixing the vulnerability. however,
             due to extensive OEM bundling the embargo is extended
2018.05.18  public disclosure of the redacted advisory
2018.06.18  full disclosure of the vulnerability details

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists