SCO UnixWare 'uidadmin' Vulnerability
BID:842
Info
SCO UnixWare 'uidadmin' Vulnerability
| Bugtraq ID: | 842 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 02 1998 12:00AM |
| Updated: | Dec 02 1998 12:00AM |
| Credit: | This vulnerability was discovered and posted to the Bugtraq mailing list by Brock Tellier on 2 Dec 99. |
| Vulnerable: |
SCO Unixware 7.1.1 SCO Unixware 7.1 SCO Unixware 7.0.1 SCO Unixware 7.0 |
| Not Vulnerable: | |
Discussion
SCO UnixWare 'uidadmin' Vulnerability
Certain versions of SCO Unixware ship with an exploitable version of the /usr/bin/uidadmin program. The problem lies in that 'uidadmin' runs with root privileges and performs insecure writes to a scratch directory (/tmp/ in this instance). A malicious user may overwrite any existing file on the system with their own data provided the files do not already exist, or they may overwrite existing files with a single string.
This symlink attack is not typical due to specific features within the Unixware OS. The following excerpt is from a the discoverer of this bug, Brock Tellier. The message in it's entirety is referenced in the 'Credit' section of this vulnerability entry.
" UnixWare's system privileges are assigned two-fold. First, it has the standard UNIX suid/sgid conventions. Second, it has a list of programs and the additional privileges they gain when run in /etc/security/tcb/privs.
For instance, /usr/bin/ping is *not* suid/sgid but may still perform raw socket operations because it gains the "driver" privilege in the privs file. Even ln, cp, mkdir and so on must have filesystem modification privileges in this file in order to perform their respective functions.
A program which has "allprivs" defined in /etc/security/tcb/privs may perform any operation as though this program was suid-root. If we are able to overflow a buffer, for instance, in one of these allprivs programs, we could run shellcode normally, but only after we've set our uid to 0. Similarly if we overflowed ping, we could do all the socket operations we want, but we could NOT gain root access.
The uidadmin program does not have allprivs defined, so we cannot just cut to the setreuid(0,0) chase and execute our shell. uidadmin does, however, have the dacwrite privilege and can therefore override all of the normal UNIX DAC (Discretionary Access Control) security precautions (including filemode bits).
Because of the way uidadmin opens "uidata.tmp", we can only either create a file with any contents we desire anywhere on the system (as long as it doesn't exist) or overwrite an existing file with our string."
Certain versions of SCO Unixware ship with an exploitable version of the /usr/bin/uidadmin program. The problem lies in that 'uidadmin' runs with root privileges and performs insecure writes to a scratch directory (/tmp/ in this instance). A malicious user may overwrite any existing file on the system with their own data provided the files do not already exist, or they may overwrite existing files with a single string.
This symlink attack is not typical due to specific features within the Unixware OS. The following excerpt is from a the discoverer of this bug, Brock Tellier. The message in it's entirety is referenced in the 'Credit' section of this vulnerability entry.
" UnixWare's system privileges are assigned two-fold. First, it has the standard UNIX suid/sgid conventions. Second, it has a list of programs and the additional privileges they gain when run in /etc/security/tcb/privs.
For instance, /usr/bin/ping is *not* suid/sgid but may still perform raw socket operations because it gains the "driver" privilege in the privs file. Even ln, cp, mkdir and so on must have filesystem modification privileges in this file in order to perform their respective functions.
A program which has "allprivs" defined in /etc/security/tcb/privs may perform any operation as though this program was suid-root. If we are able to overflow a buffer, for instance, in one of these allprivs programs, we could run shellcode normally, but only after we've set our uid to 0. Similarly if we overflowed ping, we could do all the socket operations we want, but we could NOT gain root access.
The uidadmin program does not have allprivs defined, so we cannot just cut to the setreuid(0,0) chase and execute our shell. uidadmin does, however, have the dacwrite privilege and can therefore override all of the normal UNIX DAC (Discretionary Access Control) security precautions (including filemode bits).
Because of the way uidadmin opens "uidata.tmp", we can only either create a file with any contents we desire anywhere on the system (as long as it doesn't exist) or overwrite an existing file with our string."
Exploit / POC
Solution / Fix
SCO UnixWare 'uidadmin' Vulnerability
Solution:
SSE046 has been released to fix security holes in uidadmin:
ftp://ftp.sco.com/SSE/sse046.tar.Z
This patch should only be installed on UnixWare 7.0 through 7.1.1.
Installation:
1. Create a temporary directory, and copy sse046 into it:
# mkdir /tmp/sse046
# cp sse046.tar /tmp/sse046
2. Extract files from the tar file:
# cd /tmp/sse046
# tar xvf sse046.tar
3. Follow the instructions in sse7046a.txt
Disclaimer: SCO believes that this patch addresses the reported vulnerability. However, in order that it be released as soon as possible, this patch has not been fully tested or packaged to SCO's normal exacting standards. For that reason, this patch is not officially supported. Official supported and packaged fixes for current SCO products will be available in due course.
Solution:
SSE046 has been released to fix security holes in uidadmin:
ftp://ftp.sco.com/SSE/sse046.tar.Z
This patch should only be installed on UnixWare 7.0 through 7.1.1.
Installation:
1. Create a temporary directory, and copy sse046 into it:
# mkdir /tmp/sse046
# cp sse046.tar /tmp/sse046
2. Extract files from the tar file:
# cd /tmp/sse046
# tar xvf sse046.tar
3. Follow the instructions in sse7046a.txt
Disclaimer: SCO believes that this patch addresses the reported vulnerability. However, in order that it be released as soon as possible, this patch has not been fully tested or packaged to SCO's normal exacting standards. For that reason, this patch is not officially supported. Official supported and packaged fixes for current SCO products will be available in due course.
References
SCO UnixWare 'uidadmin' Vulnerability
References:
References: