Solaris /usr/bin/solstice bug
Description: | /usr/bin/solstice is setgid bin and gives this privilege away freely. |
Author: | Unknown (it was known before the attached post) |
Compromise: | group bin, which leads quickly to root (local) |
Vulnerable Systems: | Systems with vulnerable /usr/bin/solstice (Solaris 2.5, 2.5.1) |
Date: | 18 October 1996 (known prior to this) |
Notes: | See addendum. |
Exploit:
From: Grant Kaufmann (gkaufman@cs.uct.ac.za)
Date: Fri, 18 Oct 1996 09:36:56 +0200
/usr/bin/solstice is a program launcher under solaris 2.5
Unfortunately, for some reason, it is distributed set-gid bin,
and politely launches any programs without revoking this.
The exploit:
---
(ignore any warnings/errors along the way)
/usr/bin/solstice
click Launcher
click Add Applications
fill in any arbitary things for the fields, stick the program
you want to run as setgid bin (or create a sgid shell)
click on the icon which appears with your app name.
---
As an aside, is there any reason why Solaris distributes
with so many important (like /etc and /bin) as writable by
group? This really converts a lot of not-so-dangerous
set-gid vulnerabilities to root vulnerabilities.
--
Grant
--
http://www.cs.uct.ac.za/~gkaufman/pgp.html
Addendum:
Here is patch information:
From: Casper Dik (casper@HOLLAND.SUN.COM)
Date: Sat, 19 Oct 1996 11:28:11 +0200
>/usr/bin/solstice is a program launcher under solaris 2.5
>Unfortunately, for some reason, it is distributed set-gid bin,
>and politely launches any programs without revoking this.
>The exploit:
This is a well known bug which has already been discussed here at length.
/usr/bin/solstice was first shipped with SOlaris 2.5/SunOS 5.5 so older
versions are not at risk.
These patches fix the bug, alternatively you can just remove the set-gid bit.
103245-07: Solaris 2.5_x86: admintool patch
103247-07: SunOS 5.5: admintool patch
103558-05: SunOS 5.5.1: admintool fixes for security and missing swmtool options
103559-05: SunOS 5.5.1_x86: admintool fixes for security/missing swmtool options
103560-05: SunOS 5.5.1_ppc: admintool fixes for security/missing swmtool options
The master index of all exploits is available
here (Very large file)
Or you can pick your favorite operating system:
This page is part of Fyodor's exploit
world. Please do not steal
it. For a free program to automate scanning your network for vulnerable
hosts and services, check out my network mapping tool, nmap.