Local root exploit in SuSE Linux 7.3Pro

2003-10-07T00:00:00
ID SECURITYVULNS:DOC:5215
Type securityvulns
Reporter Securityvulns
Modified 2003-10-07T00:00:00

Description

Affected:               SuSE Linux 7.3Pro Not affected:           SuSE Linux 8.2Pro, non-SuSE distributions Possibly affected:      other SuSE distributions Vulnerable package:     javarunt

Impact:                 Local user can gain root privileges Exploit type:           Symlink attack Release date:           October 6th 2003 Vendor status:          SuSE was contacted on September 4th (> 1 month ago).                         No SuSE-patch yet.

A symlink vulnerability exists in the shell script /sbin/conf.d/SuSEconfig.javarunt. This file is part of the package "javarunt" (Java runtime environment).

This vulnerability can be used by a local attacker to gain root privileges. An exploit has already been written by me, but I will not release it before October 20th.

Workaround: As there is no SuSE patch available yet, you will have to fix this yourself. You can use the following quick'n'dirty patch to fix the issue. Note however that I am NOT responsible if you mess up your system! You should know what you're doing!

In the mentioned script you should replace every occurrence of

/tmp/.java_wrapper

with the following:

/root/.java_wrapper.$$

Again, this is not pretty but it should work.

This advisory, contact information and the exploit can be found at http://www.hu-berlin.de/~nordhaus/sec/vul/index.html

-- Beware of he, who would deny you access to information. For in his heart, he dreams himself your master.