Sun Solaris BSMUNCONV Root Crontab Overwrite Vulnerability

Bugtraq ID:	13747
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Aug 02 2001 12:00AM
Updated:	Aug 02 2001 12:00AM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Sun SunOS 5.8 _x86 Sun SunOS 5.8 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 2.8
Not Vulnerable:

Sun Solaris BSMUNCONV Root Crontab Overwrite Vulnerability

Bsmunconv is prone to overwriting root's crontab file.

It is conjectured that this issue is due to a failure of the utility to ensure that the '/tmp/root' directory doesn't exist prior to execution.

This vulnerability allows local attackers to overwrite root's crontab file. It is not known at this time if attackers can control the contents of the new crontab file. This vulnerability may allow attackers to execute arbitrary script commands with superuser privileges.

Sun describes this issue as: "4383308 bsmunconv over writes root's cron tab if cu has created dir called /tmp/root"

Sun Solaris BSMUNCONV Root Crontab Overwrite Vulnerability

An exploit is not required.

Sun Solaris BSMUNCONV Root Crontab Overwrite Vulnerability

Solution:
Sun has released patches to address this issue:


Sun Solaris 8_x86

• Sun 111070-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-111070-01-1

Sun Solaris 8_sparc

• Sun 111069-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-111069-01-1

Sun Solaris 2.8

• Sun 111069-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-111069-01-1

Sun SunOS 5.8

• Sun 111069-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-111069-01-1

Sun SunOS 5.8 _x86

• Sun 111070-01
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-111070-01-1

Sun Solaris BSMUNCONV Root Crontab Overwrite Vulnerability

References:

• Solaris[tm] Product Line (Sun Microsystems)