Multiple Vendor CDE dtappgather Vulnerabilities
BID:131
Info
Multiple Vendor CDE dtappgather Vulnerabilities
| Bugtraq ID: | 131 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 03 1999 12:00AM |
| Updated: | Nov 03 1999 12:00AM |
| Credit: | This vulnerability existed in the wild several months prior to it being disclosed by CERT on January 21, 1998. The exploit for this vulnerability was first made public by Mastoras ([email protected]) on the Bugtraq mailing list on February 23, 1998 |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 SCO Unixware 7.0 IBM AIX 4.3 IBM AIX 4.2 IBM AIX 4.1 HP HP-UX 11.0 HP HP-UX 10.20 |
| Not Vulnerable: | |
Discussion
Multiple Vendor CDE dtappgather Vulnerabilities
Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file present on the filesystem, regardless of the owner of the file.
dtappgather uses a directory of permissions 0777 to create temporary files used by each login session. /var/dt/appconfig/appmanager/generic-display-0 is not checked for existence prior to the opening of the file by dtappgather, and as such, if a user were to create a symbolic link from this file to another on the filesystem, the permissions of this file would be changed to 0666.
An additional bug exists whereby dtappgather blindly uses the contents of the DTUSERSESSION environment variable. By setting this variable to point to a file on the filesystem, its permissions can also be changed. As this command takes place relative to the /var/dt/appconfig directory, a series of '..' are required to establish the root directory, after which any file can be altered.
Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file present on the filesystem, regardless of the owner of the file.
dtappgather uses a directory of permissions 0777 to create temporary files used by each login session. /var/dt/appconfig/appmanager/generic-display-0 is not checked for existence prior to the opening of the file by dtappgather, and as such, if a user were to create a symbolic link from this file to another on the filesystem, the permissions of this file would be changed to 0666.
An additional bug exists whereby dtappgather blindly uses the contents of the DTUSERSESSION environment variable. By setting this variable to point to a file on the filesystem, its permissions can also be changed. As this command takes place relative to the /var/dt/appconfig directory, a series of '..' are required to establish the root directory, after which any file can be altered.
Solution / Fix
Multiple Vendor CDE dtappgather Vulnerabilities
Solution:
A simple temporary measure is to remove the setuid bit from the dtappgather application. In most situations, this change will go unnoticed, and may actually server well from a security perspective. Setting the sticky bit on the /var/dt/appconfig directory will solve part of this problem.
The affected vendors each issued patches, which were documented in CERT advisory CA-98.02.
Solution:
A simple temporary measure is to remove the setuid bit from the dtappgather application. In most situations, this change will go unnoticed, and may actually server well from a security perspective. Setting the sticky bit on the /var/dt/appconfig directory will solve part of this problem.
The affected vendors each issued patches, which were documented in CERT advisory CA-98.02.