Vulnerability Note VU#405955

util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility

Overview

The util-linux package contains a race condition vulnerability that can be used to elevate privileges on the system.

I. Description

util-linux is shipped with Red Hat Linux and numerous other Linux distributions. It contains a collection of utility programs, such as fstab, mkfs, and chfn. The BindView RAZOR Team has discovered that because setpwnam.c inadequately locks a temporary file used when making changes to /etc/passwd, a race condition can be used to elevate privileges on the system.

For further details, please see the Bindview Advisory.

II. Impact

A local user may be able to elevate their privileges on the system.

III. Solution

Apply a patch from your vendor, or, an immediate workaround (provided by BindView) is to remove setuid flags from /usr/bin/chfn and /usr/bin/chsh. To remediate the vulnerability, patch the source code as follows.

--- util-linux-2.11n-old/login-utils/setpwnam.c Mon Jul 31 08:50:39 2000 +++ util-linux-2.11n/login-utils/setpwnam.c Wed Jun 12 21:37:12 2002 @@ -98,7 +98,8 @@ /* sanity check */ for (x = 0; x < 3; x++) { if (x > 0) sleep(1); - fd = open(PTMPTMP_FILE, O_WRONLY|O_CREAT, 0644); + // Never share the temporary file. + fd = open(PTMPTMP_FILE, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { umask(oldumask); return -1;

Systems Affected

Vendor	Status	Date Updated
3Com	Unknown	10-Jul-2002
Alcatel	Not Vulnerable	24-Jul-2002
Apple Computer Inc.	Unknown	10-Jul-2002
AT&T	Unknown	28-Jun-2002
BSDI	Unknown	10-Jul-2002
Cisco Systems Inc.	Unknown	28-Jun-2002
Compaq Computer Corporation	Unknown	10-Jul-2002
Computer Associates	Unknown	10-Jul-2002
Cray Inc.	Not Vulnerable	10-Jul-2002
Data General	Unknown	10-Jul-2002
Debian	Not Vulnerable	27-Jun-2002
F5 Networks	Unknown	28-Jun-2002
FreeBSD	Unknown	10-Jul-2002
Fujitsu	Unknown	28-Jun-2002
Guardian Digital Inc.	Unknown	10-Jul-2002
Hewlett-Packard Company	Unknown	27-Jun-2002
IBM	Not Vulnerable	17-Jul-2002
Intel	Unknown	28-Jun-2002
Juniper Networks	Unknown	28-Jun-2002
Lachman	Unknown	10-Jul-2002
Lotus Software	Not Vulnerable	11-Jul-2002
Lucent Technologies	Unknown	27-Jun-2002
MandrakeSoft	Unknown	28-Jun-2002
Microsoft Corporation	Not Vulnerable	12-Jul-2002
Multinet	Unknown	10-Jul-2002
NEC Corporation	Unknown	28-Jun-2002
NetBSD	Not Vulnerable	12-Jul-2002
Network Appliance	Unknown	28-Jun-2002
Nortel Networks	Unknown	10-Jul-2002
OpenBSD	Unknown	28-Jun-2002
Openwall GNU/*/Linux	Not Vulnerable	15-Aug-2002
Oracle Corporation	Unknown	28-Jun-2002
Red Hat Inc.	Vulnerable	10-Jul-2002
Sequent	Unknown	28-Jun-2002
SGI	Unknown	10-Jul-2002
Sony Corporation	Unknown	28-Jun-2002
Sun Microsystems Inc.	Vulnerable	17-Jul-2002
SuSE Inc.	Not Vulnerable	15-Jul-2002
The SCO Group (SCO Linux)	Vulnerable	30-Oct-2002
Unisphere Networks	Unknown	28-Jun-2002
Unisys	Unknown	10-Jul-2002
Wind River Systems Inc.	Unknown	10-Jul-2002
Xerox Corporation	Not Vulnerable	30-May-2003

References

http://www.securityfocus.com/bid/5344

Credit

Thanks to Michal Zalewski, BindView RAZOR, for reporting this vulnerability.

This document was written by Ian A Finlay.

Other Information

Date Public	07/29/2002
Date First Published	07/29/2002 02:57:48 PM
Date Last Updated	05/30/2003
CERT Advisory
CVE Name	CAN-2002-0638
US-CERT Technical Alerts
Metric	10.97
Document Revision	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader