OpenBSD Default Crontab root Compromise Vulnerability
BID:4495
Info
OpenBSD Default Crontab root Compromise Vulnerability
| Bugtraq ID: | 4495 |
| Class: | Environment Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Yes |
| Published: | Apr 11 2002 12:00AM |
| Updated: | Apr 11 2002 12:00AM |
| Credit: | Discovered by Milos Urbanek <[email protected]>. |
| Vulnerable: |
OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 3.0 |
| Not Vulnerable: | |
Discussion
OpenBSD Default Crontab root Compromise Vulnerability
OpenBSD ships with a number of cron jobs configured by default. The tasks are for the purpose of summarizing system information.
The mail(1) utility is used to send the summaries to the root user. This utility supports escaped characters in message text indicating commands to be executed during processing.
If attacker-supplied data can be included in the message text passed to mail(1), commands specified by the attacker may be executed as root. If the attacker embeds the escape sequence followed by an arbitrary command in this data, the commands will be executed as root when the cron task runs. It is possible for an attacker to embed data in filenames, which are included in the emails.
OpenBSD ships with a number of cron jobs configured by default. The tasks are for the purpose of summarizing system information.
The mail(1) utility is used to send the summaries to the root user. This utility supports escaped characters in message text indicating commands to be executed during processing.
If attacker-supplied data can be included in the message text passed to mail(1), commands specified by the attacker may be executed as root. If the attacker embeds the escape sequence followed by an arbitrary command in this data, the commands will be executed as root when the cron task runs. It is possible for an attacker to embed data in filenames, which are included in the emails.
Exploit / POC
OpenBSD Default Crontab root Compromise Vulnerability
Przemyslaw Frasunek <[email protected]> has made an exploit available.
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Przemyslaw Frasunek <[email protected]> has made an exploit available.
CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
OpenBSD Default Crontab root Compromise Vulnerability
Solution:
An CVS fix is available from OpenBSD:
OpenBSD OpenBSD 3.0
Solution:
An CVS fix is available from OpenBSD:
OpenBSD OpenBSD 3.0
-
OpenBSD OpenBSD 3.0 collect.c CVS Fix
It may be required to upgrade to OpenBSD 3.0 before this patch (from CVS) can be applied. If this is not possible, it is suggested that the cron tasks be disabled.
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/mail/collect.c.diff? r1=1.23&r2=1.24
References
OpenBSD Default Crontab root Compromise Vulnerability
References:
References:
- OpenBSD 3.2 release errata & patch list (OpenBSD)
- OpenBSD crontab-mail(~) exploit (CORE Security)
- OpenBSD Security Information (OpenBSD)