[UNIX] SCO Unixware Setuid ptrace Local Privilege Escalation
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 27 Feb 2006 19:06:16 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SCO Unixware Setuid ptrace Local Privilege Escalation
------------------------------------------------------------------------
SUMMARY
<http://www.caldera.com/products/unixware> SCO Unixware is a Unix
operating system that runs on many OEM platforms.
Local exploitation of an access validation error in SCO Unixware allows
attackers to gain root privileges.
DETAILS
Vulnerable Systems:
* SCO Unixware 7.1.3 and 7.1.4. (previous versions are suspected to be
vulnerable.)
The vulnerability specifically exists due to a failure to check
permissions on traced executables. The ptrace() system call provides an
interface for debugging other processes on the system. SCO Unixware's
implementation of the ptrace system call fails to check for setuid
permissions on binaries before attaching to the process. This results in
the complete control of memory and execution for the traced process with
root privileges. Attackers can inject data into the running setuid process
and execute arbitrary code with root permissions.
Exploitation of this vulnerability is trivial. Simply placing shellcode in
the environment and changing the instruction pointer via ptrace() is
enough to elevate privileges.
Workaround:
It is not possible to reduce the impact of this vulnerability other than
to restrict access to the affected systems.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2934>
CAN-2005-2934
Disclosure Timeline:
* 15.09.05 - Initial vendor notification
* 13.10.05 - Initial vendor response
* 24.01.06 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://www.idefense.com/intelligence/vulnerabilities/display.php?id=395>
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=395
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NT] ArGoSoft FTP Server DELE Buffer Overflow
- Next by Date: [EXPL] SCO Unixware ptrace Local Privilege Escalation Exploit
- Previous by thread: [NT] ArGoSoft FTP Server DELE Buffer Overflow
- Next by thread: [EXPL] SCO Unixware ptrace Local Privilege Escalation Exploit
- Index(es):
Relevant Pages
- [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability
in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by
default. ... permissions and thus granted all local users the privilege to execute the
... (Securiteam) - [UNIX] SCO Multiple Local Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer
overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges.
... (Securiteam) - [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing
application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability
in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled
by ... (Securiteam) - [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have
been recently discovered in Tikiwiki, ... Remote exploitation of an input validation
vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on
the vulnerable ... (Securiteam) - [NT] Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, Collaboration Suite SMTP Format
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Multiple Vulnerabilities
(IMail IMAP LIST Command DoS, ... Collaboration Suite SMTP Format String) ... Remote
exploitation of a denial of service vulnerability in Ipswitch ... (Securiteam)
