SunOS /usr/release/bin/winstall Vulnerability
BID:22
Info
SunOS /usr/release/bin/winstall Vulnerability
| Bugtraq ID: | 22 |
| Class: | Environment Error |
| CVE: |
CVE-1999-1123 |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 1991 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | |
| Vulnerable: |
Sun SunOS 4.1.1 Sun SunOS 4.1 PSR_A Sun SunOS 4.1 Sun SunOS 4.0.3 c Sun SunOS 4.0.3 |
| Not Vulnerable: | |
Discussion
SunOS /usr/release/bin/winstall Vulnerability
This applies to sites that have installed Sun Source tapes only.
The Sun distribution of sources (sunsrc) has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall. These are both binary files which exec other programs: "make -k install" (makeinstall) or "install" (winstall) without a full path or reseting the PATH enviroment variable.
This makes it possible for users on that system to become root.
This applies to sites that have installed Sun Source tapes only.
The Sun distribution of sources (sunsrc) has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall. These are both binary files which exec other programs: "make -k install" (makeinstall) or "install" (winstall) without a full path or reseting the PATH enviroment variable.
This makes it possible for users on that system to become root.
Solution / Fix
SunOS /usr/release/bin/winstall Vulnerability
Solution:
chmod ug-s /usr/release/bin/{makeinstall, winstall} (if the sources have already been installed)
and/or
edit the makefile in sunsrc/release and change the SETUID definition (if the sources have been extracted from tape but not installed yet)
Solution:
chmod ug-s /usr/release/bin/{makeinstall, winstall} (if the sources have already been installed)
and/or
edit the makefile in sunsrc/release and change the SETUID definition (if the sources have been extracted from tape but not installed yet)