BID:3572

Berkeley Parallel Make Shell Definition Format String Vulnerability

Info

Berkeley Parallel Make Shell Definition Format String Vulnerability

Bugtraq ID:	3572
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 21 2001 12:00AM
Updated:	Nov 21 2001 12:00AM
Credit:	This vulnerability was first announced to Bugtraq by Paul Starzetz <[email protected]> on November 21, 2001.
Vulnerable:	SuSE Linux 7.2 SuSE Linux 7.1 x86 SuSE Linux 7.1 sparc SuSE Linux 7.1 ppc SuSE Linux 7.1 alpha SuSE Linux 7.0 sparc SuSE Linux 7.0 ppc SuSE Linux 7.0 alpha SuSE Linux 7.0 SuSE Linux 6.4 ppc SuSE Linux 6.4 alpha SuSE Linux 6.4

Not Vulnerable:

Discussion

Berkeley Parallel Make Shell Definition Format String Vulnerability

Parallel Make (pmake) is a freely available version of the make program, originally distributed with Berkeley Unix. It is designed to execute Makefiles and build programs.

pmake is not typically setuid root, although some Linux distributions default to installing it this way. When a Makefile is executed by pmake, certain user-defined variables can be set in the Makefile by the user. One such variable is the shell definition variable, or .SHELL. By supplying a format string in the check= field of the .SHELL variable, it is possible to write to an arbitrary memory address of the program. This could result in the overwriting of the return address, and execution of arbitrary code with root privileges.