Android 4.2.x Superuser Unsanitized Environment

`Vulnerable releases of several common Android Superuser packages may  
allow malicious Android applications to execute arbitrary commands as  
root without notifying the device owner:  
  
- ChainsDD Superuser (current releases, including v3.1.3)  
- CyanogenMod/ClockWorkMod/Koush Superuser (current releases,  
including v1.0.2.1)  
- Chainfire SuperSU prior to v1.69  
  
The majority of third-party ROMs include one of these packages.  
  
On a rooted Android <= 4.2.x device, /system/xbin/su is a setuid root  
binary which performs a number of privilege checks in order to  
determine whether the operation requested by the caller should be  
allowed. In the course of its normal duties, and prior to making the  
allow/deny decision, /system/xbin/su invokes external programs under a  
privileged UID, typically root (0) or system (1000):  
  
- /system/bin/log, to record activity to logcat  
- /system/bin/am, to send intents to the Superuser Java app  
- /system/bin/sh, to execute the /system/bin/am wrapper script  
- /system/bin/app_process, the Dalvik VM  
  
The user who invokes /system/xbin/su may have the ability to  
manipulate the environment variables, file descriptors, signals,  
rlimits, tty/stdin/stdout/stderr, and possibly other items belonging  
to any of these subprocesses. At least two vulnerabilities are  
readily apparent:  
  
- On ClockWorkMod Superuser, /system/xbin/su does not set PATH to a  
known-good value, so a malicious user could trick /system/bin/am into  
using a trojaned app_process binary:  
  
echo -e '#!/system/bin/sh\nexport PATH=/system/bin:$PATH\ntouch  
/data/trojan.out\nexec $0 "$@"' > app_process ; chmod 755 app_process  
PATH=`pwd`:$PATH su -c 'true'  
  
The PATH vulnerability is being tracked under CVE-2013-6768.  
  
- Other environment variables could be used to affect the behavior of  
the (moderately complex) subprocesses. For instance, manipulation of  
BOOTCLASSPATH could cause a malicious .jar file to be loaded into the  
privileged Dalvik VM instance. All three Superuser implementations  
allowed Dalvik's BOOTCLASSPATH to be supplied by the attacker.  
  
The BOOTCLASSPATH vulnerability is being tracked under CVE-2013-6774.  
`