HP-UX CDE Default PATH Vulnerability
BID:541
Info
HP-UX CDE Default PATH Vulnerability
| Bugtraq ID: | 541 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 27 1999 12:00AM |
| Updated: | Jul 27 1999 12:00AM |
| Credit: | First released in HP Security Advisory HPSBUX9907-100 on July 19, 1999. |
| Vulnerable: |
HP HP-UX (VVOS) 10.24 HP HP-UX 10.34 HP HP-UX 10.30 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.9 HP HP-UX 10.8 HP HP-UX 10.1 0 HP HP-UX 10.0 |
| Not Vulnerable: | |
Discussion
HP-UX CDE Default PATH Vulnerability
In the HP9000 700/800 series running HP-UX 10.X, users who log in using CDE have the current directory as part of the environment variable PATH. This vulnerability allows for an attacker to disguise malicious executables as commonly used system utilities (like ls) in world writeable directories to be executed unknowingly by another user or by root (when in that directory). An example of this is below:
Attacker with regular user permissions creates shell script called 'ls' in all world writeable directories.
'./ls' first executes the regular /bin/ls, then leaving a setuid root shell somewhere (or adds an entry to /etc/passwd or writes to /.rhosts).
To the user running what they think is 'ls', nothing seems wrong.
In the HP9000 700/800 series running HP-UX 10.X, users who log in using CDE have the current directory as part of the environment variable PATH. This vulnerability allows for an attacker to disguise malicious executables as commonly used system utilities (like ls) in world writeable directories to be executed unknowingly by another user or by root (when in that directory). An example of this is below:
Attacker with regular user permissions creates shell script called 'ls' in all world writeable directories.
'./ls' first executes the regular /bin/ls, then leaving a setuid root shell somewhere (or adds an entry to /etc/passwd or writes to /.rhosts).
To the user running what they think is 'ls', nothing seems wrong.
Exploit / POC
HP-UX CDE Default PATH Vulnerability
See Discussion.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
See Discussion.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
HP-UX CDE Default PATH Vulnerability
Solution:
In /usr/dt/bin/Xsession just before this:
# ###########################################################################
#
# Startup section.
Add this:
###################### Clean up $PATH for root ##########################
if [ "$USER" = "root" ]
then
Log "Clean up PATH for root user"
Log "Old PATH = $PATH"
PATH=`echo $PATH | awk '
{
# Remove elements from PATH that are
# (a) "."
# (b) ""
# (c) blank
#
gsub (" ",":", $0) # Substitite ":" for each blank
n = split ($0, path, ":") # Split into elements with ":" as delimiter
first = 1 # To suppress leading ":" in new PATH
for (i=1; i<=n; i++) {
len = length(path[i])
dot = index(path[i], ".")
dot_only = 0
if ((len == 1) && (dot==1)) {
dot_only = 1
}
# print element if it is not "" and not "."
if (!(len==0) && !(dot_only==1)) {
if(first != 1) {
printf (":") # if not first element, print ":" in front
}
printf ("%s",path[i])
first = 0
}
}
}
END { printf ("\n") }'`
Log "New PATH = $PATH"
fi
###################### End - Clean up $PATH for root ####################
Solution:
In /usr/dt/bin/Xsession just before this:
# ###########################################################################
#
# Startup section.
Add this:
###################### Clean up $PATH for root ##########################
if [ "$USER" = "root" ]
then
Log "Clean up PATH for root user"
Log "Old PATH = $PATH"
PATH=`echo $PATH | awk '
{
# Remove elements from PATH that are
# (a) "."
# (b) ""
# (c) blank
#
gsub (" ",":", $0) # Substitite ":" for each blank
n = split ($0, path, ":") # Split into elements with ":" as delimiter
first = 1 # To suppress leading ":" in new PATH
for (i=1; i<=n; i++) {
len = length(path[i])
dot = index(path[i], ".")
dot_only = 0
if ((len == 1) && (dot==1)) {
dot_only = 1
}
# print element if it is not "" and not "."
if (!(len==0) && !(dot_only==1)) {
if(first != 1) {
printf (":") # if not first element, print ":" in front
}
printf ("%s",path[i])
first = 0
}
}
}
END { printf ("\n") }'`
Log "New PATH = $PATH"
fi
###################### End - Clean up $PATH for root ####################