Solaris admintool Insecure Temporary File Creation Vulnerability
BID:289
Info
Solaris admintool Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 289 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 25 1996 12:00AM |
| Updated: | Jul 25 1996 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on July 25th 1996 by Leif Hedstrom <[email protected]>. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 |
| Not Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 |
Discussion
Solaris admintool Insecure Temporary File Creation Vulnerability
Admintool is a graphical user interface that enables an administrator to perform several system administration tasks on a Solaris system. These tasks include the ability to manage users, groups, hosts and other services.
Due to insecure creation of temporary files in the /tmp directory users may create or delete files anywhere on the file system by using symlinks to the insecurely created temporary files. This allows an intruder or malevolant user to trivially gain root privelages.
The following is a work around provided in the AUSCERT AL-96.03 advisory on this problem:
# chmod 400 /usr/bin/admintool
# ls -l /usr/bin/admintool
-r-------- 1 root sys 303516 Oct 27 1995 /usr/bin/admintool
Note that if only the setuid permissions are removed, it is still possible for users to gain privileges when admintool is executed as root.
Admintool is a graphical user interface that enables an administrator to perform several system administration tasks on a Solaris system. These tasks include the ability to manage users, groups, hosts and other services.
Due to insecure creation of temporary files in the /tmp directory users may create or delete files anywhere on the file system by using symlinks to the insecurely created temporary files. This allows an intruder or malevolant user to trivially gain root privelages.
The following is a work around provided in the AUSCERT AL-96.03 advisory on this problem:
# chmod 400 /usr/bin/admintool
# ls -l /usr/bin/admintool
-r-------- 1 root sys 303516 Oct 27 1995 /usr/bin/admintool
Note that if only the setuid permissions are removed, it is still possible for users to gain privileges when admintool is executed as root.
Exploit / POC
Solaris admintool Insecure Temporary File Creation Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Solaris admintool Insecure Temporary File Creation Vulnerability
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Sun Solaris 2.5
Sun Solaris 2.5_x86
Sun Solaris 2.5.1 _x86
Sun Solaris 2.5.1
Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com
Sun Solaris 2.5
-
Sun 103247-07
sparc
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103247-07-1
Sun Solaris 2.5_x86
-
Sun 103245-08
x86
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103245-08-1
Sun Solaris 2.5.1 _x86
-
Sun 103559-07
x86
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103559-07-1
Sun Solaris 2.5.1
-
Sun 103558-10
Sparc
http://sunsolve.sun.com/search/document.do?assetkey=1-21-103558-10-1
References
Solaris admintool Insecure Temporary File Creation Vulnerability
References:
References:
- Australian CERT (AUSCERT)
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)