MagniComp SysInfo Information Exposure

`MagniComp SysInfo Information Exposure [CVE-2018-7268]  
======================================================  
The latest version of this advisory is available at:  
https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt  
  
  
Overview  
--------  
  
MagniComp SysInfo contains a information exposure vulnerability through debug  
functionality.  
  
  
Description  
-----------  
  
Due to a combination of setuid binary and verbose debugging, MagniComp SysInfo can be  
used to read any file on the system owned by root (uid 0).  
  
  
Impact  
------  
  
A local unprivileged user is able to read any root (uid 0) owned file on the system,  
regardless of the file permissions. Confidential information such as password hashes  
(/etc/shadow) or other secrets (such as log files, private keys) can be leaked to  
the attacker. The vulnerability has a confidentiality impact, but has no direct impact  
on system integrity or availability.  
  
  
Details  
-------  
  
The discovered vulnerabilities, described in more detail below, enable the attack  
described here in brief.  
  
1. A local attacker executes the following command to obtain access to /etc/shadow:  
$ /opt/sysinfo/bin/sysinfo --licensevalid /etc/shadow --debug 2>&1 | grep PARSE:  
2. The attacker performs further attacks on the exposed password hashes  
  
The attacker is able to use the vulnerability to expose other confidential  
information, too, such as private keys, configuration and log files.  
  
  
Vulnerabilities  
---------------  
  
1. CWE-215: Information Exposure Through Debug Information [CVE-2018-7268]  
  
The SysInfo mcsiwrapper is installed setuid root. The --licensevalid option reads  
the license file, parses it and returns validity status of the license. Due to an  
oversight enabling debug output with --debug also outputs the contents of the file to  
the stderr while performing the parsing, exposing the file contents in the process.  
  
The vulnerability can only be used to read files owned by root (uid 0). An attempt  
to read a file owned by someone else is met with the following error:  
  
"mcsiwrapper: CERROR: Option --licensefile is unsafe: "/home/user/foo" REASON: Path  
must be owned by uid 0 or uid 0 when running setuid: path owned by uid 1000."  
  
  
Vulnerable versions  
-------------------  
  
The following SysInfo versions are confirmed vulnerable:  
  
- Linux/Unix/Mac SysInfo versions up and including 10.0 (H80)  
  
Notably MagniComp SysInfo is bundled with the BMC BladeLogic Automation product. With  
BMC BladeLogic installations the tool can be found from the following location:  
/opt/bmc/bladelogic/RSCD/nativetool/bin  
  
  
Mitigation  
----------  
  
1. Upgrade to SysInfo 10-H81 or later  
  
  
Similar or prior work  
---------------------  
  
1. Unrelated earlier privilege escalation vulnerability CVE-2017-6516 -  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6516  
  
  
Credits  
-------  
  
The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.  
  
  
Timeline  
--------  
  
2018.02.13 discovered the vulnerability  
2018.02.14 wrote a preliminary advisory  
2018.02.14 contacted MagniComp at [email protected] requesting security contact  
2018.02.14 sent vulnerability details to CERT-FI vulncoord  
2018.02.15 sent vulnerability details to MagniComp security contact  
2018.02.16 MagniComp acknowledged the vulnerability  
2018.02.20 requested CVE ID from MITRE  
2018.02.21 CVE-2018-7268 assigned by MITRE  
2018.02.22 MagniComp released SysInfo 10-H81 fixing the vulnerability. however,  
due to extensive OEM bundling the embargo is extended  
2018.05.18 public disclosure of the redacted advisory  
2018.06.18 full disclosure of the vulnerability details  
  
  
`