Home page logo
/

bugtraq logo Bugtraq mailing list archives

L0pht Advisory: initscripts-4.48-1 RedHat Linux 6.1
From: mudge () L0PHT COM (Mudge)
Date: Mon, 27 Dec 1999 22:09:46 -0500


                           L0pht Security Advisory

                         Advisory Released 12.27.1999
                 Application: initscripts-4.48-1 on RedHat Linux
      Severity: A malicious local user can execute arbitrary code as another
                   user who logs in with the csh or tcsh shell
         Status: Problem is believed fixed -- see RHSA-199:052-04

                           Author mudge () l0pht com
                   http://www.l0pht.com/advisories.html

Overview:

The initscripts package contains, among other things, the default system
shell initialization scripts. These scripts are executed upon login for
users automatically. This advisory adresses a problem with one of the
script's insecure use of temporary files. We describe the problem, offer
a quick solution, and then provide a tool for demonstration of the attack.

[ Note: We missed the fact that RedHat had fixed this problem but they have :)
    This advisory is being released so that people can see how we approached
    the problem, the tool that was created for proof of concept, and
    ideas on how to avoid these types of problems in scripts. The RedHat
    Advisory is RHSA-1999:052-04 ]

Description:

The system-wide csh.login ( /etc/csh.login ) file tests for the existance
of the /etc/profile.d directory. If the directory exists it sources each
file that exists in the directory that has a '.csh' suffix. Of these
scripts, the lang.csh file tests for the existance of the
/etc/sysconfig/i18n file and, if it exists, creates a shell script from
the file after converting it to csh syntax. This file is created in
the /tmp directory using the process ID as it's extension.

The offending lines of the code are:

    sed 's|=C$|=en_US|g' /etc/sysconfig/i18n | sed "s|=| |g"  \
        | sed "s|^\([^#]\)|setenv \0|g" > /tmp/csh.$$
    source /tmp/csh.$$
    rm -f /tmp/csh.$$

As one can see, predicting the pid and pre-creating a link needs a few
slight tweaks to work here. If the file linked to does not have the
correct restrictive permissions, the redirection of the output from
the sed(1) command will overwrite the file. If this happens the only
chance for attack here is to replace the file between the end of the
sed(1)  line and before the next script command that sources the target
file. This is an extremely small window to race.

If however, the temporary file is pre-created with a link pointing to
a file with restrictive permissions such as 0444 then the destructive
redirection of the output from the sed(1) command will fail. The
next line will source the pre-created file and the line after that will
attempt to remove it.

The only caveat to this is that the user logging in will see an error
message on the attempt to redirect the output into the pre-created
file.  However, experience shows that the majority of users ignore such
messages.

All of the requirements for this attack to work are met in the default US
full install of RedHat 6.1.

Quick solution:

If temporary files must be created in public areas, which is not the
only way to do it here, then proper care must be taken. One possible
solution is to create a subdirectory in the public area and continue
with the needed temporary files residing there. This solution works
when care is taken to check the return value of the mkdir(1) command
and use its atomic nature to ensure that race tricks are not played.

  mkdir --mode=700 /tmp/csh_login.$$
  if ($status != 0) then
    echo "potential problem -- directory /tmp/csh_login.$$ already exists!"
    exit
  endif

  sed 's|=C$|=en_US|g' /etc/sysconfig/i18n | sed "s|=| |g"  | sed "s|^\([^#]\)|setenv \0|g" > /tmp/csh_login.$$/csh.$$
    source /tmp/csh_login.$$/csh.$$
    rm -f /tmp/csh_login.$$/csh.$$
    rmdir /tmp/csh_login.$$

The diff appears as follows:

--- /etc/profile.d/lang.csh     Sun Sep 26 13:49:11 1999
+++ ./lang.csh.modified Sun Dec 26 20:59:25 1999
@@ -3,7 +3,14 @@
 test -f /etc/sysconfig/i18n
 if ($status == 0) then
-    sed 's|=C$|=en_US|g' /etc/sysconfig/i18n | sed "s|=| |g"  | sed "s|^\([^#]\)|setenv \0|g" > /tmp/csh.$$
-    source /tmp/csh.$$
-    rm -f /tmp/csh.$$
+    /bin/mkdir --mode=700 /tmp/csh_login.$$
+    if ($status != 0) then
+      echo "potential problem -- directory /tmp/csh_login.$$ already exists!"
+      exit
+    endif
+
+    sed 's|=C$|=en_US|g' /etc/sysconfig/i18n | sed "s|=| |g"  | sed "s|^\([^#]\)|setenv \0|g" > 
/tmp/csh_login.$$/csh.$$
+    source /tmp/csh_login.$$/csh.$$
+    rm -f /tmp/csh_login.$$/csh.$$
+    /bin/rmdir /tmp/csh_login.$$

     if ($?SYSFONTACM) then

Exploit:

The exploit tools can be found at the following URL:
                http://www.l0pht.com/advisories/init.tar.gz

The exploit works as follows:

    The script to force the user to execute is specified on the command
    line. If the script is not prepped with the correct permissions they
    are altered. It should be noted that the full path and filename
    should be specified here for the target script.

    The program watches /etc/csh.login for the access time to
    change.

    Upon seeing the a_time change the /proc directory is opened and
    walked looking for processes with the name of (tcsh).

    For each entry it sees, a symbolic link is created to the target
    script suffixed with the tcsh process ID.

    The targeted file is then watched for the a_time to change, which
    would signify execution. Upon seeing this the symbolic links that
    were created in the /tmp directory are removed.

    A sample might be to create a file in /var/tmp such as demo.csh
    which would contain the following:

      touch /tmp/`/usr/bin/whoami`.$$

      And run the program as: ./init_race -f /var/tmp/demo.csh

      The user logging in will see the error message
        /tmp/csh.## : Permission denied.
      Which signifies that we have won the race and a file will
      be created in the /tmp directory with the users name and the
      current pid. Of course, a malicious user could specify more
      nefarious scripts could be used in place of the above benign sample.

cheers,

.mudge

mudge () l0pht com

  [ For more advisories check out http://www.l0pht.com/advisories.html ]


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault