what you don't know can hurt you

MagniComp SysInfo Information Exposure

MagniComp SysInfo Information Exposure
Posted Jun 18, 2018
Authored by Harry Sintonen

MagniComp SysInfo contains a information exposure vulnerability through debug functionality. Versions SysInfo 10-H81 and above are not affected.

tags | exploit, info disclosure
advisories | CVE-2018-7268
MD5 | 05af244c6663efde83caac79a67b4878

MagniComp SysInfo Information Exposure

Change Mirror Download
MagniComp SysInfo Information Exposure [CVE-2018-7268]
======================================================
The latest version of this advisory is available at:
https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt


Overview
--------

MagniComp SysInfo contains a information exposure vulnerability through debug
functionality.


Description
-----------

Due to a combination of setuid binary and verbose debugging, MagniComp SysInfo can be
used to read any file on the system owned by root (uid 0).


Impact
------

A local unprivileged user is able to read any root (uid 0) owned file on the system,
regardless of the file permissions. Confidential information such as password hashes
(/etc/shadow) or other secrets (such as log files, private keys) can be leaked to
the attacker. The vulnerability has a confidentiality impact, but has no direct impact
on system integrity or availability.


Details
-------

The discovered vulnerabilities, described in more detail below, enable the attack
described here in brief.

1. A local attacker executes the following command to obtain access to /etc/shadow:
$ /opt/sysinfo/bin/sysinfo --licensevalid /etc/shadow --debug 2>&1 | grep PARSE:
2. The attacker performs further attacks on the exposed password hashes

The attacker is able to use the vulnerability to expose other confidential
information, too, such as private keys, configuration and log files.


Vulnerabilities
---------------

1. CWE-215: Information Exposure Through Debug Information [CVE-2018-7268]

The SysInfo mcsiwrapper is installed setuid root. The --licensevalid option reads
the license file, parses it and returns validity status of the license. Due to an
oversight enabling debug output with --debug also outputs the contents of the file to
the stderr while performing the parsing, exposing the file contents in the process.

The vulnerability can only be used to read files owned by root (uid 0). An attempt
to read a file owned by someone else is met with the following error:

"mcsiwrapper: CERROR: Option --licensefile is unsafe: "/home/user/foo" REASON: Path
must be owned by uid 0 or uid 0 when running setuid: path owned by uid 1000."


Vulnerable versions
-------------------

The following SysInfo versions are confirmed vulnerable:

- Linux/Unix/Mac SysInfo versions up and including 10.0 (H80)

Notably MagniComp SysInfo is bundled with the BMC BladeLogic Automation product. With
BMC BladeLogic installations the tool can be found from the following location:
/opt/bmc/bladelogic/RSCD/nativetool/bin


Mitigation
----------

1. Upgrade to SysInfo 10-H81 or later


Similar or prior work
---------------------

1. Unrelated earlier privilege escalation vulnerability CVE-2017-6516 -
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6516


Credits
-------

The vulnerability was discovered by Harry Sintonen / F-Secure Corporation.


Timeline
--------

2018.02.13 discovered the vulnerability
2018.02.14 wrote a preliminary advisory
2018.02.14 contacted MagniComp at info@magnicomp.com requesting security contact
2018.02.14 sent vulnerability details to CERT-FI vulncoord
2018.02.15 sent vulnerability details to MagniComp security contact
2018.02.16 MagniComp acknowledged the vulnerability
2018.02.20 requested CVE ID from MITRE
2018.02.21 CVE-2018-7268 assigned by MITRE
2018.02.22 MagniComp released SysInfo 10-H81 fixing the vulnerability. however,
due to extensive OEM bundling the embargo is extended
2018.05.18 public disclosure of the redacted advisory
2018.06.18 full disclosure of the vulnerability details


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close