[UNIX] net-snmp Fixproc Race Condition

From: SecuriTeam (support_at_securiteam.com)
Date: 05/25/05

  • Next message: SecuriTeam: "[NT] Computer Associates Vet Antivirus Library Heap Overflow" 
    To: list@securiteam.com
Date: 25 May 2005 11:36:27 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      net-snmp Fixproc Race Condition
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.net-snmp.org/> Net-SNMP is a suite of applications used to
    implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6."

    A race condition vulnerability was found with net-snmp fixproc program
    that allows attackers to execute programs with root privileges by creating
    a temporary file that will be then used by fixproc.

    DETAILS

    Vulnerable Systems:
     * net-snmp version 5.2.1 and prior

    fixproc creates a temporary file using a name created by the process ID
    number. This number is very easy to guess by attackers thus they are able
    execute arbitrary UNIX commands with root privileges.

    Code Snips:
    Just take a look at /usr/bin/fixproc Line 233:

    # it must be "shell", so execute the shell script defined in database

    local ($tmpfile) = "/tmp/fix_$$";

    &create_sh_script ($fix{$proc}, $tmpfile);

    # return code is number divided by 256
    $error_code = (system "$tmpfile") / 256;

    ..
    sub create_sh_script
    {
       local ($file) = pop (@_);
       local ($i) = pop (@_);

       printf (stderr "create_sh_script\n") if ($debug > 0);

       $! = $fixproc_error;
       open (file, ">"."$file") || die "$0: cannot open $file\n";
       while ( $shell_lines[$i] ne $shell_end_marker )
         {
           printf (file "%s", $shell_lines[$i]);
           $i++;
         }
       close (file);
       system "chmod +x $file";
       return file;
    }
    ..

    sub do_check
    {
     local ($proc) = pop(@_);

      printf (stderr "do_check\n") if ($debug > 0);

     if ($check{$proc} eq '')
     {
       $! = $fixproc_error;
       die "$0: internal error 2\n";
     }

     if ($check{$proc} ne 'exist')
     {
       # if not "exist", then it must be "shell", so
       execute the shell script
       # defined in database

      local ($tmpfile) = "/tmp/check_$$";

      &create_sh_script ($check{$proc}, $tmpfile);

      # return code is number divided by 256
      $error_code = (system "$tmpfile") / 256;
      system "rm $tmpfile";
      return ($check_failed_error) if ($error_code != 0);

      # check passed, continue
     }
     return &do_exist ($proc);
    }

    Workaround:
    Change the the temporary file into a name generated by /dev/random.

    Disclosure Timeline:
    2005-05-07 Discovered
    2005-05-17 Vendor notified
    2005-05-23 Vendor response - Disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:exploits@zataz.net>
    ZATAZ.net.
    The original article can be found at:
    <http://www.zataz.net/adviso/net-snmp-05182005.txt>
    http://www.zataz.net/adviso/net-snmp-05182005.txt
    The bug report about this vulnerability can be found at:
    <http://sourceforge.net/tracker/index.php?func=detail&aid=1203376&group_id=12694&atid=112694> http://sourceforge.net/tracker/index.php?func=detail&aid=1203376&group_id=12694&atid=112694

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Computer Associates Vet Antivirus Library Heap Overflow"

    Relevant Pages

    • [NT] Multiple Vendor Insecure use of CreateProcess()
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Improper use of Windows API command CreateProcess allows attackers to ... until a module is encountered to execute. ... This creates a scenario whereby arbitrary code could be executed. ...
      (Securiteam)
    • [NT] Switch Off Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Stack-based Buffer Overflow: ... execute arbitrary code on the remote system - possibly with SYSTEM ... boundaries until the ecx register reaches zero (where the ecx was the ...
      (Securiteam)
    • [NEWS] URL Parsing and Plain Text Password disclosure in Best Buy Employee Toolkit Software
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... entered in the URL area and an attacker could use this to execute a local ... command shell or execute other programs locally stored. ... Store's central server. ...
      (Securiteam)
    • [UNIX] Open Webmail Remote Command Execution (userstat.pl)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A remote attacker can run arbitrary commands with the web ... The vulnerability was discovered in an obsolete script named userstat.pl ... commands an attacker would want to execute. ...
      (Securiteam)
    • [UNIX] xloadimage Multiple Vulnerabilities (Buffer Overflow, Command Execution)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... to execute arbitrary commands via malformed images. ... Multiple buffer overflow in xloadimage allow remote attackers to execute ... Under Linux the buffer overflows allow remote attackers to execute ...
      (Securiteam)