SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Internet Manager (mana) Vendors:   Santa Cruz Operations
(Vendor Issues Fix) Re: SCO Internet Manager (mana) Environment Variable Validation Flaw Lets Local Users Grab Root Privileges
SecurityTracker Alert ID:  1007714
SecurityTracker URL:  http://securitytracker.com/id/1007714
CVE Reference:   CVE-2003-0742   (Links to External Site)
Date:  Sep 16 2003
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in the Internet Manager (mana) application for SCO UNIX. A local user can obtain root privileges on the system.

Texonet issued an advisory warning that a local user can set the REMOTE_ADDR environment variable to '127.0.0.1' and then run '/usr/internet/admin/mana/mana' to cause the application to execute the 'menu.mana' file without requiring authentication.

The advisory also indicates that a local user can set the PATH_INFO to '/pass-err.mana' and the PATH to './:$PATH' to cause would make mana to execute the './hostname' file with root privileges.

A demonstration exploit is provided in the Source Message.

Impact:   A local user can cause 'mana' to execute arbitrary code with root level privileges.
Solution:   SCO has issued a fix for OpenServer 5.0.7, OpenServer 5.0.6, and OpenServer 5.0.5:

"Location of Fixed Binaries

ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.19

Verification

MD5 (VOL.000.000) = 37b55df2c9000c703a22baafbe9cef42

md5 is available for download from
ftp://ftp.sco.com/pub/security/tools

Installing Fixed Binaries

Upgrade the affected binaries with the following sequence:

1) Download the VOL* files to the /tmp directory

2) Run the custom command, specify an install from media images, and specify the /tmp directory as the location of the images."

Vendor URL:  www.sco.com/support/security/index.html (Links to External Site)
Cause:   Authentication error, Input validation error
Underlying OS:  UNIX (Open UNIX-SCO)
Underlying OS Comments:  5.0.5 - 5.0.7

Message History:   This archive entry is a follow-up to the message listed below.
Sep 15 2003 SCO Internet Manager (mana) Environment Variable Validation Flaw Lets Local Users Grab Root Privileges



 Source Message Contents

Subject:  OpenServer 5.0.7 OpenServer 5.0.6 OpenServer 5.0.5 : SCO Internet Manager - local users can gain root level privileges.



To: bugtraq@securityfocus.com full-disclosure@lists.netsys.com announce@lists.caldera.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenServer 5.0.7 OpenServer 5.0.6 OpenServer 5.0.5 : SCO Internet Manager - local users can gain root level privileges.
Advisory number: 	CSSA-2003-SCO.19
Issue date: 		2003 September 10
Cross reference:	sr883947 fz528244 erg712420
______________________________________________________________________________


1. Problem Description

	 The SCO Internet Manager (mana) is designed to be run via
	 the ncsa_httpd on port 615 and it is password protected.

	 Running /usr/internet/admin/mana/mana locally is however
	 possible. 
	 
	 By exporting the environment variable REMOTE_ADDR
	 and setting it to 127.0.0.1 mana is tricked to execute the
	 file menu.mana as if it was run via the nsca_httpd password
	 protected area. 
	 
	 An other interesting environment variable is PATH_INFO 
	 which tells mana what .mana file should be run. 
	 
	 This tells us that mana will execute "hostname" when 
	 this file is run. By changing the environment
	 variables PATH_INFO to /pass-err.mana and PATH to ./:$PATH
	 would make mana execute ./hostname with root privileges.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	OpenServer 5.0.5 - 5.0.7 	/mana/mana
					/mana/doc/menu.mana
					/mana/doc/initdone.mana
					/mana/doc/passerr.mana
					/mana/manahttp

3. Solution

	The proper solution is to install the latest packages.


4. OpenServer 5.0.7, OpenServer 5.0.6, and OpenServer 5.0.5

	4.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.19


	4.2 Verification

	MD5 (VOL.000.000) = 37b55df2c9000c703a22baafbe9cef42

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following sequence:

	1) Download the VOL* files to the /tmp directory

	2) Run the custom command, specify an install from media
	images, and specify the /tmp directory as the location of
	the images.


5. References

	Specific references for this advisory:
		http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0742 
		http://www.texonet.com/advisories/TEXONET-20030902.txt

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr883947 fz528244
	erg712420.


6. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers
	intended to promote secure installation and use of SCO
	products.


7. Acknowledgments

	SCO would like to thank Texonet. Texonet is a Swedish based
	security company with a focus on penetration testing /
	security assessments, research and development.

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQE/ZXLGaqoBO7ipriERAsQnAJ0XHFi5iDf+m3FEXkrfXeg4FJpSogCfc/8o
j07hHDy47bTVZ6Mg7AjZGNU=
=uxcz
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC