7602983 2001-12-01 01:56 +1300  /85 rader/ zen-parse <zen-parse@gmx.net>
Sänt av: joel@lysator.liu.se
Importerad: 2001-12-01  00:01  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <19981>
Ärende: Redhat 7.0 local root (via uucp) (attempt 2)
------------------------------------------------------------
From: zen-parse <zen-parse@gmx.net>
To: <bugtraq@securityfocus.com>
Message-ID: <Pine.LNX.4.33.0112010119440.1058-101000@clarity.local>

Affects:  RedHat 7.0 (possibly others)

28 Aug 2001 01:27:24 +1200 uucp vulnerability exposed to vendor
 9 Nov 2001 07:14:15 +1300 this makewhatis vulnerability exposed to vendor

/usr/sbin/makewhatis 

An earlier version(1) of makewhatis had a fault in the handling of 
compressed files that allowed execution of arbitrary commands as root.
 
A patch for this problem was developed that seemed to be effective.  
However, the patch was not restrictive enough in the metacharacters it
filtered out.

It is still possible to perform file creation or overwriting with
arbitrary contents, as root.


Taylor UUCP package and uucp exploit.

The uucp utilities fail to filter out long options, which lets users
specify alternate configurations and as a result, execute commands
with  uid and gid uucp. (2)

Attached is an exploit for uucp (developed for RedHat 7.0, but other 
vulnerable distributions should be similar).


The root exploit.

drwxrwxr-x    4 root     uucp         4096 Nov 30 19:48 /var/lock/

On RH7.0 uucp allows arbitrary filename creation through the lockfile
creation performed by /etc/cron.{daily,weekly}/makewhatis.cron.

--- Start /etc/cron.daily/makewhatis.cron ---
#!/bin/bash

LOCKFILE=/var/lock/makewhatis.lock

# the lockfile is not meant to be perfect, it's just in case the
# two makewhatis cron scripts get run close to each other to keep
# them from stepping on each other's toes.  The worst that will
# happen is that they will temporarily corrupt the database...
[ -f $LOCKFILE ] && exit 0
trap "rm -f $LOCKFILE" EXIT
touch $LOCKFILE
makewhatis -u -w
exit 0
--- End /etc/cron.daily/makewhatis.cron ---

Simply symlinking /var/lock/makewhatis.lock to the filename u want to 
create will cause it to be created. 

This root exploit is only for RedHat 7.0, but a similar method may
work on  other distributions.


-- zen-parse
(1) http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=42450
Previous makewhatis problem.

(2) http://www.securityfocus.com/bid/3312
Taylor UUCP vulnerability.

(3) http://mp3.com/cosv
Some starving musicians.

This is my 2nd attempt to post this: if it was rejected for any reason
last time, would be nice to know why. If the previous one had just
disappeared, that would be strange.

-- 
-------------------------------------------------------------------------
The preceding information is confidential and may not be redistributed
without explicit permission. Legal action may be taken to enforce this.  
If this message was posted by zen-parse@gmx.net to a public forum it may
be redistributed as long as these conditions remain attached. If you are
mum or dad, this probably doesn't apply to you.
(7602983) /zen-parse <zen-parse@gmx.net>/-(Ombruten)
Bilaga (application/x-gzip) i text 7602984
7602984 2001-12-01 01:56 +1300  /3 rader/ zen-parse <zen-parse@gmx.net>
Bilagans filnamn: "redhat7.0-uucp-to-root.tar.gz"
Importerad: 2001-12-01  00:01  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <19982>
Bilaga (text/plain) till text 7602983
Ärende: Bilaga (redhat7.0-uucp-to-root.tar.gz) till: Redhat 7.0 local root (via uucp) (attempt 2)
------------------------------------------------------------
‹U­<íXûoÛ6ÎÏü+®iQ']ôò3pÓÅÖ Š¶¨4Û\ ²D[Z$R
)ÇNÛÿ}¤–-ÛI†òs"E÷
¼OwtöWôLÛHS/15¥Â:Ø%l»m÷z=y·åÝ^¹8°{mÛvšÝvGÚ9N«{F±).8¸ÃÄH\Æñ»‡ôÿS°ÍùdzÄÀ,6y°ƒ9lGæ»ÓٖÿV·ÙZä¿ÙjJû^[åßÞÁÜâÏÿÓ'Ö($ö
XˆL M€‹t<Fƒ1+å,3LSâƾp™Ï>1:rGÑE#‰ÜÕ(¾	/
ÏB
£Ë‹wƒ‹ƒËWߊQŒèâØnýYÀzVYxmM]f‰8±XJDr8;ûòöüݵ²Až+–,¦Ss*Õo?ž£$ù!êãlži9<*&®ŒÃÃb «+)B2|±*/%ÈÇ£´æ“¦™¥ä†Ð[c—øÞ¼_>Hòˆ`áÒÏ/Å®öÕñ9¯M™ºÑª¦” „²Zœ¥©­È7i]Yî”|Ý4HÌI˜`TD\¹M°Pi]r-’bDO#atÂܸòÿƒ1Ûä].9wŽçkÉñÜÈàXÅR<0ìáp*׋D(m]2Wû&p¯$ C»×kuO;6‡vÏÒƔ&fFç<¼+ÀÓ0Ê.è÷œçÆ0’q8yµJŕQšù0e„O2%O(,¥¨Ømʟòéºå´ZÛknì1kÃq"æ…÷&¢®…EU$²;‹ÁW¶.÷
à(‚\­öeI̓{Lƒ˜úðßh¡f^¶š­¯¬N§ÀôJ.¹!9:Fßp,ž„þ‘tÊîÇ'†sü²P¤…"]Ràö¢£Ãb͇'‡êbKÍÏb¯<0èæªd‘™Aã±üÈ3Qg„9å&­êbã¿
ZQ÷‘T“Lë5ª@ˆWu¬ƒãDõ…¦Ü79¹ÏMĕš¥Ûç”e¡<³šÈ«Š’¬Éò£b{
‹J´( e-ÈV’ïJYöËtç­h*_áùóMrÙ£²Ø38wì
(cs³qÿP™‹kMaã„¨êQ[è[¬)¢­K÷Úÿ·œÿ²õ×.N€œÿì®Ó[=ÿ5åŸúü·T¥}©ªËV{cÅî
¾•Ü¹©žQDÀàùA.ÃҀ¨_ǚ
aøløýӛˋaßöáOÉçºèV²iøZ~jr9a]”Õ«ºÐc”ÔeŠ¡Ã3„阓»{‚ŸÜ…²pzc0d»P/›ŠF¶
Pý”ŸÚi¥hŠáZ;ÜÐê²7Yž—‚ªÁ­Êó³RYªY÷žÿ-￬EñΘþÐûïtœêû¿#¿:ݎTë÷¨¸üaœÈ|ëÎAPÕtAq
(Ï’!'pÎBø@§ÐlsÚoÙýö)|øëKP™Kÿ5€30WšÈþ™­¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡¡ñkã_È0Bë(
(7602984) /zen-parse <zen-parse@gmx.net>/-(Ombruten)