Corel Linux buildxconfig Vulnerabilities
BID:1007
Info
Corel Linux buildxconfig Vulnerabilities
| Bugtraq ID: | 1007 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 24 2000 12:00AM |
| Updated: | Feb 24 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by <[email protected]> on February 24, 2000. |
| Vulnerable: |
Corel Linux OS 1.0 |
| Not Vulnerable: | |
Discussion
Corel Linux buildxconfig Vulnerabilities
Several vulnerabilities exist in the buildxconfig program, as included with Corel Linux 1.0. Using this program, it is likely that a local user could elevate privileges.
By failing to check input to the -f and -x flags, it is possible for an attacker to append to existing files, or create files that previously didn't exist. Using the -f argument, and supplying a filename that does exist, it is possible to append information to a file. Using the -x argument, and a file that does exist, it is possible toreplace the first line of any file with the path to the X server selected. Finally, if either flag is passed the name of a file that does not exist, it will create it, with read, write and execute permission available for all users on the system.
Several vulnerabilities exist in the buildxconfig program, as included with Corel Linux 1.0. Using this program, it is likely that a local user could elevate privileges.
By failing to check input to the -f and -x flags, it is possible for an attacker to append to existing files, or create files that previously didn't exist. Using the -f argument, and supplying a filename that does exist, it is possible to append information to a file. Using the -x argument, and a file that does exist, it is possible toreplace the first line of any file with the path to the X server selected. Finally, if either flag is passed the name of a file that does not exist, it will create it, with read, write and execute permission available for all users on the system.
Exploit / POC
Corel Linux buildxconfig Vulnerabilities
Method 1: buildxconfig -f /etc/shadow
Method 2: buildxconfig -x /etc/passwd
Method 3:
umask 0
buildxconfig -x /.rhosts
echo "+ +" > /.rhosts
Method 1: buildxconfig -f /etc/shadow
Method 2: buildxconfig -x /etc/passwd
Method 3:
umask 0
buildxconfig -x /.rhosts
echo "+ +" > /.rhosts
Solution / Fix
Corel Linux buildxconfig Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Removal of the setuid bit from this binary will remove the problem:
chmod -s /sbin/buildxconfig
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Removal of the setuid bit from this binary will remove the problem:
chmod -s /sbin/buildxconfig
References
Corel Linux buildxconfig Vulnerabilities
References:
References: