SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
BID:43
Info
SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
| Bugtraq ID: | 43 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 1992 12:00AM |
| Updated: | May 27 1992 12:00AM |
| Credit: | |
| Vulnerable: |
Sun SunOS 4.1.3 c Sun SunOS 4.1.3 Sun SunOS 4.1.2 Sun SunOS 4.1.1 Sun SunOS 4.1 PSR_A Sun SunOS 4.1 Sun SunOS 4.0.3 c Sun SunOS 4.0.3 Sun SunOS 4.0.2 Sun SunOS 4.0.1 Sun SunOS 4.0 |
| Not Vulnerable: |
Sun SunOS 4.1.3 _U1 |
Discussion
SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
There exists a vulnerability involving environment variables and setuid/setgid programs under SunOS 4.0 and higher.
A dynamically-linked program that is invoked by a setuid/setgid program has access to the caller's LD_* environmental variables if the setuid/setgid program sets the real and effective UIDs to be equal and the real and effective GIDs to be equal before the dynamically-linked program is executed. A vulnerability exists if the UIDs and GIDs are not equal to those of the user that invoked the setuid/setgid program.
This is Sun Bug ID 1085851 and 1085853.
In particular, SunOS /usr/lib/sendmail, /usr/bin/login, /usr/bin/su, and /usr/5bin/su are vulnerable to this problem.
In-house and third-party software can also be impacted by this vulnerability. For example, the current versions of rnews, sudo, smount, and npasswd are known to be vulnerable under SunOS.
This or similar vulnerabilities have been found in other unix operating systems.
It seems Sun's solution is to call the dynamicly linked programs without both the real and effective uid and gid being the same. This is rather subobtimal as third party programs are left vulnerable. A better solutio is to mark a process as having changed it's uid or gid within the kernel. The dynamic linker can then query this information and use the LD_* variables depending on the results.
There exists a vulnerability involving environment variables and setuid/setgid programs under SunOS 4.0 and higher.
A dynamically-linked program that is invoked by a setuid/setgid program has access to the caller's LD_* environmental variables if the setuid/setgid program sets the real and effective UIDs to be equal and the real and effective GIDs to be equal before the dynamically-linked program is executed. A vulnerability exists if the UIDs and GIDs are not equal to those of the user that invoked the setuid/setgid program.
This is Sun Bug ID 1085851 and 1085853.
In particular, SunOS /usr/lib/sendmail, /usr/bin/login, /usr/bin/su, and /usr/5bin/su are vulnerable to this problem.
In-house and third-party software can also be impacted by this vulnerability. For example, the current versions of rnews, sudo, smount, and npasswd are known to be vulnerable under SunOS.
This or similar vulnerabilities have been found in other unix operating systems.
It seems Sun's solution is to call the dynamicly linked programs without both the real and effective uid and gid being the same. This is rather subobtimal as third party programs are left vulnerable. A better solutio is to mark a process as having changed it's uid or gid within the kernel. The dynamic linker can then query this information and use the LD_* variables depending on the results.
Exploit / POC
SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
$ mkdir /tmp/mylib
$ cp libevil.so /tmp/mylib
$ export LD_LIBRARY_PATH=/tmp/mylib
$ /bin/login
#
$ mkdir /tmp/mylib
$ cp libevil.so /tmp/mylib
$ export LD_LIBRARY_PATH=/tmp/mylib
$ /bin/login
#
Solution / Fix
SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
Solution:
For SunOS 4.1, 4.1.1 and 4.1.2:
Apply Sun Patch ID 100630-01 (login and su) and
Sun Patch ID 100377-04.
Note: PatchID 100630-01 contains the international version of
/usr/bin/login. PatchID 100631-01 contains the domestic version
of /usr/bin/login and is only available from Sun Answer Centers for
sites that use the US Encryption Kit.
Solution:
For SunOS 4.1, 4.1.1 and 4.1.2:
Apply Sun Patch ID 100630-01 (login and su) and
Sun Patch ID 100377-04.
Note: PatchID 100630-01 contains the international version of
/usr/bin/login. PatchID 100631-01 contains the domestic version
of /usr/bin/login and is only available from Sun Answer Centers for
sites that use the US Encryption Kit.
References
SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability
References:
References:
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)