The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Local root exploit in SuSE Linux 8.2Pro


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Mon, 6 Oct 2003 15:08:02 +0200
From: Stefan Nordhausen <[email protected]>
To: [email protected]
Subject: Local root exploit in SuSE Linux 8.2Pro

Affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE Linux 8.2Pro
Not affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE Linux 7.3Pro, non-SuSE d=
istributions
Possibly affected:=A0=A0=A0=A0=A0=A0other SuSE distributions
Vulnerable package:=A0=A0=A0=A0=A0susewm

Impact:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0Local user can ga=
in root privileges
Exploit type:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0Symlink attack
Release date:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0October 6th 2003
Vendor status:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE was contacted on September=
 4th (> 1 month ago).
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0No =
SuSE-patch yet.


A symlink vulnerability exists in the shell script=20
/sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the=20
"susewm" package. This package is required by the package "kdebase3", so if=
=20
KDE3 is installed on your system(s), you should be vulnerable.

This vulnerability can be used by a local attacker to gain root privileges.=
 An=20
exploit has already been written by me, but I will not release it before=20
October 20th.


Workaround:
As there is no SuSE patch available yet, you will have to fix this yourself=
=2E=20
You can use the following quick'n'dirty patch to fix the issue. Note howeve=
r=20
that I am NOT responsible if you mess up your system! You should know what=
=20
you're doing!

In the mentioned script you should replace _every_ occurrence of

$r/tmp/susewm.$$

with the following:

$r/root/susewm.$$

It's not pretty, but it should work.

This advisory, contact information and the exploit can be found at=20
http://www.hu-berlin.de/~nordhaus/sec/vul/index.html

=2D-
You cannot spell "believe" without "lie".

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру