ISC INN inndstart pathrun Vulnerability
BID:254
Info
ISC INN inndstart pathrun Vulnerability
| Bugtraq ID: | 254 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 11 1999 12:00AM |
| Updated: | May 11 1999 12:00AM |
| Credit: | This vulnerability was published in the BUGTRAQ mailing list by Forrest J. Cavalier III <[email protected]>. |
| Vulnerable: |
ISC INN 2.2 ISC INN 2.1 ISC INN 2.0 |
| Not Vulnerable: |
ISC INN 1.7.2 ISC INN 1.7 |
Discussion
ISC INN inndstart pathrun Vulnerability
It is possibly for the news user to fool the inndstart program such that is does not drop root privileges and then executes an arbitrary program as root.
Inndstart is a suid root wrapper program whose purpose is to bind to a privileged port, change its user id to that of the "news" user, and the execute the "innd" deamon. inndstart determines the uid and gid it should change to by examining the ownership of a directory normally owned by the user "news" and group "news". The directory that is examined can be changed by editing the "pathrun" parameter in the "inn.conf" configuration file.
By specifying a directory with root ownership inndstart can be made to execute innd as root. The are several ways in which you can then make innd execute arbitrary programs as root.
It is possibly for the news user to fool the inndstart program such that is does not drop root privileges and then executes an arbitrary program as root.
Inndstart is a suid root wrapper program whose purpose is to bind to a privileged port, change its user id to that of the "news" user, and the execute the "innd" deamon. inndstart determines the uid and gid it should change to by examining the ownership of a directory normally owned by the user "news" and group "news". The directory that is examined can be changed by editing the "pathrun" parameter in the "inn.conf" configuration file.
By specifying a directory with root ownership inndstart can be made to execute innd as root. The are several ways in which you can then make innd execute arbitrary programs as root.
Exploit / POC
ISC INN inndstart pathrun Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
ISC INN inndstart pathrun Vulnerability
Solution:
Modify the source file innd/inndstart.c to use a hard coded pathrun, instead of the structure member innconf->pathrun.
Solution:
Modify the source file innd/inndstart.c to use a hard coded pathrun, instead of the structure member innconf->pathrun.