From: SecuriTeam <support@securiteam.com.>
To: list@securiteam.com
Date: 27 Feb 2006 19:06:16 +0200
Subject: [UNIX] SCO Unixware Setuid ptrace Local Privilege Escalation
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060228184451.7E7735830@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
X-Spam-Status: No, hits=2.102 tagged_above=2 required=5
tests=DATE_IN_PAST_24_48, MSGID_FROM_MTA_ID
X-Spam-Level: **
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SCO Unixware Setuid ptrace Local Privilege Escalation
------------------------------------------------------------------------
SUMMARY
<http://www.caldera.com/products/unixware>; SCO Unixware is a Unix
operating system that runs on many OEM platforms.
Local exploitation of an access validation error in SCO Unixware allows
attackers to gain root privileges.
DETAILS
Vulnerable Systems:
* SCO Unixware 7.1.3 and 7.1.4. (previous versions are suspected to be
vulnerable.)
The vulnerability specifically exists due to a failure to check
permissions on traced executables. The ptrace() system call provides an
interface for debugging other processes on the system. SCO Unixware's
implementation of the ptrace system call fails to check for setuid
permissions on binaries before attaching to the process. This results in
the complete control of memory and execution for the traced process with
root privileges. Attackers can inject data into the running setuid process
and execute arbitrary code with root permissions.
Exploitation of this vulnerability is trivial. Simply placing shellcode in
the environment and changing the instruction pointer via ptrace() is
enough to elevate privileges.
Workaround:
It is not possible to reduce the impact of this vulnerability other than
to restrict access to the affected systems.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2934>;
CAN-2005-2934
Disclosure Timeline:
* 15.09.05 - Initial vendor notification
* 13.10.05 - Initial vendor response
* 24.01.06 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://www.idefense.com/intelligence/vulnerabilities/display.php?id=395>;
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=395
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
