BMON Local Privilege Escalation Vulnerability
BID:11457
Info
BMON Local Privilege Escalation Vulnerability
| Bugtraq ID: | 11457 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 18 2004 12:00AM |
| Updated: | Oct 18 2004 12:00AM |
| Credit: | Jon Nistor reported this vulnerability to FreeBSD. |
| Vulnerable: |
Thomas Graf bmon 1.2.1 FreeBSD FreeBSD 5.2.1 -RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 |
| Not Vulnerable: |
FreeBSD FreeBSD 5.3 |
Discussion
BMON Local Privilege Escalation Vulnerability
It is reported that bmon is susceptible to a privilege escalation vulnerability if installed with setuid permissions.
This vulnerability allows local attackers to execute arbitrary code with the privileges of the bmon package. It is reported that the FreeBSD port system installs bmon with setuid superuser privileges, allowing local attackers to execute arbitrary code with superuser privileges.
This vulnerability is reported to exist in bmon version 1.2.1 on any platform that installs it with setuid privileges. Other versions may also be affected.
For FreeBSD, versions prior to 1.2.1_2 are reported susceptible. Other platforms that install bmon with setuid privileges are unknown at this time.
It is reported that bmon is susceptible to a privilege escalation vulnerability if installed with setuid permissions.
This vulnerability allows local attackers to execute arbitrary code with the privileges of the bmon package. It is reported that the FreeBSD port system installs bmon with setuid superuser privileges, allowing local attackers to execute arbitrary code with superuser privileges.
This vulnerability is reported to exist in bmon version 1.2.1 on any platform that installs it with setuid privileges. Other versions may also be affected.
For FreeBSD, versions prior to 1.2.1_2 are reported susceptible. Other platforms that install bmon with setuid privileges are unknown at this time.
Exploit / POC
BMON Local Privilege Escalation Vulnerability
An example script sufficient to exploit this vulnerability was provided by "Idan Nahoum" <[email protected]>:
An example script sufficient to exploit this vulnerability was provided by "Idan Nahoum" <[email protected]>:
Solution / Fix
BMON Local Privilege Escalation Vulnerability
Solution:
FreeBSD has updated their port system to remove the setuid bit from the bmon package. Users of affected packages should upgrade to version 1.2.1_2 or greater of the port.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
FreeBSD has updated their port system to remove the setuid bit from the bmon package. Users of affected packages should upgrade to version 1.2.1_2 or greater of the port.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
BMON Local Privilege Escalation Vulnerability
References:
References:
- bmon -- unsafe set-user-ID application (FreeBSD)
- bmon Home Page (Thomas Graf)
- FreeBSD Homepage (FreeBSD)
- Problem Report ports/67340 (FreeBSD)