[VulnWatch] @stake Advisory: TruBlueEnvironment Privilege Escalation Attack

From: @stake Advisories (@stake)
Date: 02/14/03

  • Next message: Frog Man: "[VulnWatch] php-Board (php)"
    Date: Fri, 14 Feb 2003 13:17:00 -0800
    From: "@stake Advisories" <advisories@atstake.com>
    To: vulnwatch@vulnwatch.org
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

                                    @stake, Inc.
                                  www.atstake.com

                                 Security Advisory

    Advisory Name: TruBlueEnvironment Privilege Escalation Attack
     Release Date: 02/14/2003
      Application: TruBlueEnvironment
         Platform: MacOS X (10.2.3 and below)
         Severity: Local users can gain root privileges
           Author: Dave G. <daveg@atstake.com>
    Vendor Status: updated version of OS available
    CVE Candidate: CAN-2003-0088
        Reference: www.atstake.com/research/advisories/2003/a021403-1.txt

    Overview:

    TruBlueEnvironment is part of the MacOS Classic Emulator. It
    is setuid root and installed by default. By setting certain
    environment variables, it is possible to overwrite any file on the
    system, or create arbitrary files owned as root with the attacker's
    umask. This vulnerability can be leveraged to create files that will
    get executed by root through the cron facility.

           
    Details:

    TruBluEnvironment uses an environment variable to determine where to
    write out debugging information. Local users can set this to
    environment variable to point at any file on the filesystem. If the
    file exists, it will be reset to zero bytes. If the file does not
    exist, it will be created with the umask inherited from the calling
    process. While attackers cannot create files with execute
    permissions set, they can create files that are world writable.

    Under MacOS X, this vulnerability can be used to create files that
    will be run automatically via cron. By default, cron will launch
    maintenance scripts using the periodic command. This command will
    take several files and either 'source' them or run them through a
    shell interpreter. Since these scripts are running as root, it is
    possible to obtain administrator privileges on any MacOS X system
    running cron and TruBlueEnvironment.

    Vendor Response:

    Classic: The Mac OS X 10.2.4 release fixes CAN-2003-0088, where an
    attacker may change an environment variable to create arbitrary
    files or overwrite existing files, which could lead to obtaining
    elevated privileges. Credit to Dave G. from @stake, Inc. for
    discovering this issue.

    Recommendation:

    If possible upgrade to Mac OS X 10.2.4. Another solution is to
    restrict access to the TruBlueEnvironment(*) executable, or remove
    it entirely if it is not being used. One approach to restrict
    TruBlueEnvironment executable,and only allow a specific group to
    execute the application. The following commands will restrict
    access to the 'admin' group:

    sudo chown .admin /System/Library/CoreServices/Classic\
     Startup.app/Contents/Resources/TruBlueEnvironment

    sudo chmod 4750 /System/Library/CoreServices/Classic\
     Startup.app/Contents/Resources/TruBlueEnvironment

    (*) Located in /System/Library/CoreServices/Classic
     Startup.app/Contents/Resources/TruBlueEnvironment

    Common Vulnerabilities and Exposures (CVE) Information:

    The Common Vulnerabilities and Exposures (CVE) project has assigned
    the following names to these issues. These are candidates for
    inclusion in the CVE list (http://cve.mitre.org), which standardizes
    names for security problems.

      CAN-2003-0088

    @stake Vulnerability Reporting Policy:
    http://www.atstake.com/research/policy/

    @stake Advisory Archive:
    http://www.atstake.com/research/advisories/

    PGP Key:
    http://www.atstake.com/research/pgp_key.asc

    Copyright 2003 @stake, Inc. All rights reserved.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBPk1bvEe9kNIfAm4yEQIofwCgo2KukjZyxVmEtNwhaairxO3lYP4Anjr2
    zEAcY7GhNZn+3evuuqnQsjZp
    =WZTS
    -----END PGP SIGNATURE-----