[31987] in bugtraq
Local root exploit in SuSE Linux 7.3Pro
daemon@ATHENA.MIT.EDU (Stefan Nordhausen)
Mon Oct 6 14:12:17 2003
Message-ID: <3F79A3DD002764BE@hawk.intern.zoo.tiscali.de> (added by postmaster@webmail.tiscali.de)
From: Stefan Nordhausen <deletethis.nordhaus@informatik.hu-berlin.de>
To: bugtraq@securityfocus.com
Date: Mon, 6 Oct 2003 15:06:57 +0200
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
charset="iso-8859-15"
Content-Transfer-Encoding: 8bit
Affected: SuSE Linux 7.3Pro
Not affected: SuSE Linux 8.2Pro, non-SuSE distributions
Possibly affected: other SuSE distributions
Vulnerable package: javarunt
Impact: Local user can gain root privileges
Exploit type: Symlink attack
Release date: October 6th 2003
Vendor status: SuSE was contacted on September 4th (> 1 month ago).
No SuSE-patch yet.
A symlink vulnerability exists in the shell script
/sbin/conf.d/SuSEconfig.javarunt. This file is part of the package "javarunt"
(Java runtime environment).
This vulnerability can be used by a local attacker to gain root privileges. An
exploit has already been written by me, but I will not release it before
October 20th.
Workaround:
As there is no SuSE patch available yet, you will have to fix this yourself.
You can use the following quick'n'dirty patch to fix the issue. Note however
that I am NOT responsible if you mess up your system! You should know what
you're doing!
In the mentioned script you should replace _every_ occurrence of
/tmp/.java_wrapper
with the following:
/root/.java_wrapper.$$
Again, this is not pretty but it should work.
This advisory, contact information and the exploit can be found at
http://www.hu-berlin.de/~nordhaus/sec/vul/index.html
--
Beware of he, who would deny you access to information. For in his heart, he
dreams himself your master.
