Multiple Vendor vacation(1) Vulnerability
BID:710
Info
Multiple Vendor vacation(1) Vulnerability
| Bugtraq ID: | 710 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 01 1997 12:00AM |
| Updated: | Sep 01 1997 12:00AM |
| Credit: | This advisory was posted to the Bugtraq mailing list by Secure Networks Inc. on September 1, 1997. |
| Vulnerable: |
Sun SunOS 4.1.4 Sun SunOS 4.1.3 _U1 Sun SunOS 4.1.3 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 OpenBSD OpenBSD 2.0 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1 HP HP-UX (VVOS) 10.24 HP HP-UX 11.0 HP HP-UX 10.34 HP HP-UX 10.30 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.9 HP HP-UX 10.8 HP HP-UX 10.1 0 HP HP-UX 10.0 1 HP HP-UX 10.0 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 FreeBSD FreeBSD 1.1.5 .1 |
| Not Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 |
Discussion
Multiple Vendor vacation(1) Vulnerability
Certain versions of the vacation(1) program which ship with multiple commercial and free UNIX's is vulnerable to a remote and local attack. The vacation program itself is a utility which is used in conjunction with a users .forward file to process incoming mail to be automatically replied to with a pre-written message. Typically a message informing the sender that the receiver is away on vacation. This is installed by placing a .forward file into your directory containing a line as follows:
\user, "|/usr/bin/vacation user"
The problem lies in that when vacation responds to an incoming message, it invokes the sendmail command, specifying the address of the sender on the command line. By specifying a sendmail command line option rather than a valid email address, it is possible to cause sendmail to be invoked with an alternate configuration file. This alternate configuration file can be previously sent to the system via a separate email message, or via anonymous FTP. When parsed, this new sendmail configuration file can cause sendmail to execute arbitrary commands on the remote system.
Certain versions of the vacation(1) program which ship with multiple commercial and free UNIX's is vulnerable to a remote and local attack. The vacation program itself is a utility which is used in conjunction with a users .forward file to process incoming mail to be automatically replied to with a pre-written message. Typically a message informing the sender that the receiver is away on vacation. This is installed by placing a .forward file into your directory containing a line as follows:
\user, "|/usr/bin/vacation user"
The problem lies in that when vacation responds to an incoming message, it invokes the sendmail command, specifying the address of the sender on the command line. By specifying a sendmail command line option rather than a valid email address, it is possible to cause sendmail to be invoked with an alternate configuration file. This alternate configuration file can be previously sent to the system via a separate email message, or via anonymous FTP. When parsed, this new sendmail configuration file can cause sendmail to execute arbitrary commands on the remote system.
Exploit / POC
Multiple Vendor vacation(1) Vulnerability
As taken from the NAI advisory.
By specifying the originating address of an email message to consist of a path to an alternate configuration file (i.e. -C/var/mail/user), the vacation program will invoke sendmail, and use /var/mail/user as the configuration file. If the user's mailbox contains valid sendmail configuration options, sendmail will treat the user's mail spool as a sendmail configuration file. Sendmail can be induced execute arbitrary shell commands from its configuration file. Variations on this attack may be possible using sendmail options other than -C.
As taken from the NAI advisory.
By specifying the originating address of an email message to consist of a path to an alternate configuration file (i.e. -C/var/mail/user), the vacation program will invoke sendmail, and use /var/mail/user as the configuration file. If the user's mailbox contains valid sendmail configuration options, sendmail will treat the user's mail spool as a sendmail configuration file. Sendmail can be induced execute arbitrary shell commands from its configuration file. Variations on this attack may be possible using sendmail options other than -C.
Solution / Fix
Multiple Vendor vacation(1) Vulnerability
Solution:
Please see the attached vendor advisories for patch information.
Solution:
Please see the attached vendor advisories for patch information.