Date: Mon, 18 Jun 2018 13:24:23 +0300 (EEST)
From: Harry Sintonen <fulldisclosure@...er.fi>
To: fulldisclosure@...lists.org
Subject: [FD] MagniComp SysInfo Information Exposure [CVE-2018-7268]

MagniComp SysInfo Information Exposure [CVE-2018-7268]
======================================================
The latest version of this advisory is available at:
https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt


Overview
--------

MagniComp SysInfo contains a information exposure vulnerability through debug
functionality.


Description
-----------

Due to a combination of setuid binary and verbose debugging, MagniComp SysInfo can be
used to read any file on the system owned by root (uid 0).


Impact
------

A local unprivileged user is able to read any root (uid 0) owned file on the system,
regardless of the file permissions. Confidential information such as password hashes
(/etc/shadow) or other secrets (such as log files, private keys) can be leaked to
the attacker. The vulnerability has a confidentiality impact, but has no direct impact
on system integrity or availability.


Details
-------

The discovered vulnerabilities, described in more detail below, enable the attack
described here in brief.

1. A local attacker executes the following command to obtain access to /etc/shadow:
$ /opt/sysinfo/bin/sysinfo --licensevalid /etc/shadow --debug 2>&1 | grep PARSE:
2. The attacker performs further attacks on the exposed password hashes

The attacker is able to use the vulnerability to expose other confidential
information, too, such as private keys, configuration and log files.


Vulnerabilities
---------------

1. CWE-215: Information Exposure Through Debug Information [CVE-2018-7268]

The SysInfo mcsiwrapper is installed setuid root. The --licensevalid option reads
the license file, parses it and returns validity status of the license. Due to an
oversight enabling debug output with --debug also outputs the contents of the file to
the stderr while performing the parsing, exposing the file contents in the process.

The vulnerability can only be used to read files owned by root (uid 0). An attempt
to read a file owned by someone else is met with the following error:

"mcsiwrapper: CERROR: Option --licensefile is unsafe: "/home/user/foo" REASON: Path
  must be owned by uid 0 or uid 0 when running setuid: path owned by uid 1000."


Vulnerable versions
-------------------

The following SysInfo versions are confirmed vulnerable:

- Linux/Unix/Mac SysInfo versions up and including 10.0 (H80)

Notably MagniComp SysInfo is bundled with the BMC BladeLogic Automation product. With
BMC BladeLogic installations the tool can be found from the following location:
/opt/bmc/bladelogic/RSCD/nativetool/bin


Mitigation
----------

1. Upgrade to SysInfo 10-H81 or later


Similar or prior work
---------------------

1. Unrelated earlier privilege escalation vulnerability CVE-2017-6516 -
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6516


Credits
-------

The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.


Timeline
--------

2018.02.13  discovered the vulnerability
2018.02.14  wrote a preliminary advisory
2018.02.14  contacted MagniComp at info@...nicomp.com requesting security contact
2018.02.14  sent vulnerability details to CERT-FI vulncoord
2018.02.15  sent vulnerability details to MagniComp security contact
2018.02.16  MagniComp acknowledged the vulnerability
2018.02.20  requested CVE ID from MITRE
2018.02.21  CVE-2018-7268 assigned by MITRE
2018.02.22  MagniComp released SysInfo 10-H81 fixing the vulnerability. however,
             due to extensive OEM bundling the embargo is extended
2018.05.18  public disclosure of the redacted advisory
2018.06.18  full disclosure of the vulnerability details

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists