SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Database)  >   Firebird Vendors:   firebird.sourceforge.net
Firebird Database External Tables Access Control Flaw May Let Authenticated Users Modify Arbitrary Files on the System
SecurityTracker Alert ID:  1006492
SecurityTracker URL:  http://securitytracker.com/id/1006492
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 5 2003
Impact:   Modification of system information, Modification of user information, Root access via local system, Root access via network
Exploit Included:  Yes  
Version(s): 1.0.2
Description:   A vulnerability was reported in the Firebird database in the file access permissions associated with external tables. An authenticated remote or local user can modify files on the system, potentially with root privileges.

An authenticated user can reported create a table in an external file that is an arbitrary file on the system. The software does not validate the access permissions on the file. If the file exists, the database will reportedly open the file for appending.

The default configuration reportedly installs the database server process with System level or root level privileges. So, the authenticated user can modify any file on the system.

A demonstration exploit is provided:

create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');

Some other exploit methods are described in the Source Message.

The report indicates that this flaw may be exploitable by an un-authenticated user, as some users may be able to create a database with an external table without having to authenticate first.

Impact:   An authenticated remote or local user can modify arbitrary files on the system with root privileges.
Solution:   No solution was available at the time of this entry.
Vendor URL:  firebird.sourceforge.net/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Interbase/Firebird - external file security bug


Class: IB/FB can create or modify all accessible files on disk
Remote: YES
Localy: YES

Vulnerable: IB 6.01, IB6.5, FB 1.0.2 (WIN/Linux)
Not Vulnerable: IB7.0
Not Tested: FB 1.5 Beta

Overview:

IB/FB support external file for table. Data store in raw format and
there isn't access rectriction. If file exist it's opened for R/W append
mode.
Default IB6/FB1 installation use system (win) or root(linux) account to run 
IBServer.

Precondition:

This bug is exploitable only if user is authorized into ibserver, but on
default
linux instalation FB1.0.2, I can create database and external table without 
user/password(isql has been used). And in another case, there are many 
methods how is possible get password (sniffs, brute force ...).

Description:

There tree method for abusing this security bug:

1) First method allows users to carry away binary database file.
This metod was reported on Borland QualityCentral (5.3.2002). It's
report 278. 

2)  With this issue IBserver can read and modify all files accesible on
disk. If
external table is used, only raw data are stored into file. The linux
example:

create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');

This example append r00t user into system without password and with root
access.

3) Concept of third method is to use UDF function for installation back door
into system. 

  1) cracker create external file into UDF libs dir which contain backdoor
    function,
  2) import udf function and start them from SQL,
  3) install better backdoor thru the UDF backdoor.

I don't test UDF example, but I thing that it's will work. It may be used
under other user account.

Workaround:

Upgrade to IB version 7 or you may convert process owner from root/SYSTEM to
other with more security restriction, but this isn't defence for method 1.

FB 1.0.2 contain script for convert rights from root to firebird account,
but
it's don't work correctly. All firebird's binary dirs are owned by firebird
user
and it may be abused for installation bad UDF lib.


Thanks:

Thanks to Craig Stuntz


Firebird and Iterbase team was contacted.



                    

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC