AIX snap Insecure Temporary File Creation Vulnerability
BID:375
Info
AIX snap Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 375 |
| Class: | Origin Validation Error |
| CVE: |
CVE-1999-1405 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 17 1999 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | This bug was posted to the Bugtraq mailing list by Larry W. Cashdollar <[email protected]>. Followup messages were posted by Brian Hauber <[email protected]> The Discussion and Exploit sections of this vulnerability were almost wholly based on thos |
| Vulnerable: |
IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1 IBM AIX 3.2.5 |
| Not Vulnerable: |
IBM AIX 4.3.2 IBM AIX 4.3 |
Discussion
AIX snap Insecure Temporary File Creation Vulnerability
The snap command is a diagnostic utlitiy for gathering system information on AIX platforms. It can only be executed by root, but it copies various system files into /tmp/ibmsupt/ under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext. The danger here is if a system administrator executes snap -a as sometimes requested by IBM support while diagnosing a problem it defeats password shadowing. /tmp/ibmsupt is created with 755 permissions they may carry out a symlink attack and gain access to the password file.
The snap command is a diagnostic utlitiy for gathering system information on AIX platforms. It can only be executed by root, but it copies various system files into /tmp/ibmsupt/ under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext. The danger here is if a system administrator executes snap -a as sometimes requested by IBM support while diagnosing a problem it defeats password shadowing. /tmp/ibmsupt is created with 755 permissions they may carry out a symlink attack and gain access to the password file.
Exploit / POC
AIX snap Insecure Temporary File Creation Vulnerability
snap is a shell script which uses cp -p to gather system information. Data from /etc/security is gathered between lines 721 - 727. Seeing that snap uses the /tmp/ibmsupt/general directory someone may create the directory as a normal user (tested on on AIX 4.2.1). The user may then do a touch on /tmp/ibmsupt/general/passwd. Once the passwd file is created do tail -f /tmp/ibmsupt/general/passwd. If in another session someone loggs in as root and ran snap -a - this will cause the contents of the /etc/security/passwd to show up in tail command.
snap is a shell script which uses cp -p to gather system information. Data from /etc/security is gathered between lines 721 - 727. Seeing that snap uses the /tmp/ibmsupt/general directory someone may create the directory as a normal user (tested on on AIX 4.2.1). The user may then do a touch on /tmp/ibmsupt/general/passwd. Once the passwd file is created do tail -f /tmp/ibmsupt/general/passwd. If in another session someone loggs in as root and ran snap -a - this will cause the contents of the /etc/security/passwd to show up in tail command.
Solution / Fix
AIX snap Insecure Temporary File Creation Vulnerability
Solution:
Solution:
AIX 4.3.x APAR: IX88263
AIX 4.2.x APAR: IX88261
AIX 4.1.x APAR: upgrade to later version
Solution:
Solution:
AIX 4.3.x APAR: IX88263
AIX 4.2.x APAR: IX88261
AIX 4.1.x APAR: upgrade to later version
References
AIX snap Insecure Temporary File Creation Vulnerability
References:
References:
- AIX Fix Distribution Service (IBM)
- IBM Support Databases (IBM)