SunOS kmem setgid /etc/crash Vulnerability
BID:59
Info
SunOS kmem setgid /etc/crash Vulnerability
| Bugtraq ID: | 59 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Unknown |
| Published: | Feb 03 1993 12:00AM |
| Updated: | Feb 03 1993 12:00AM |
| Credit: | This vulnerability was intially released as CERT Advisory CA-93.03. |
| Vulnerable: |
Sun SunOS 4.1.3 c Sun SunOS 4.1.3 _U1 Sun SunOS 4.1.3 Sun SunOS 4.1.2 Sun SunOS 4.1.1 Sun SunOS 4.1 PSR_A Sun SunOS 4.1 |
| Not Vulnerable: |
Sun SunOS 4.1.4 Sun Solaris 2.0 |
Discussion
SunOS kmem setgid /etc/crash Vulnerability
/etc/crash was installed setgid kmem and excutable by anyone. Any user can use the ! shell command escape to executes commands, which are then performed with group set to kmem.
This is Sun Bug ID 1054480 and 1042662.
/etc/crash was installed setgid kmem and excutable by anyone. Any user can use the ! shell command escape to executes commands, which are then performed with group set to kmem.
This is Sun Bug ID 1054480 and 1042662.
Exploit / POC
SunOS kmem setgid /etc/crash Vulnerability
$ /etc/crash
! sh
$ /etc/crash
! sh
Solution / Fix
SunOS kmem setgid /etc/crash Vulnerability
Solution:
Apply Sun Patch ID 100103-12.
Solution:
Apply Sun Patch ID 100103-12.
References
SunOS kmem setgid /etc/crash Vulnerability
References:
References:
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)