Local root exploit in SuSE Linux 8.2Pro

[Stefan Nordhausen]

Affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0=A0SuSE Linux 8.2Pro
Not affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE Linux 7.3Pro, non-SuSE d=
istributions
Possibly affected:=A0=A0=A0=A0=A0=A0other SuSE distributions
Vulnerable package:=A0=A0=A0=A0=A0susewm

Impact:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= A0=A0=A0Local user can ga=
in root privileges
Exploit type:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0Symlink attack
Release date:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0October 6th 2003
Vendor status:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE was contacted on September=
4th (> 1 month ago).
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0=A0=A0=A0=A0=A0=A0=A0No =
SuSE-patch yet.


A symlink vulnerability exists in the shell script=20
/sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the=20
"susewm" package. This package is required by the package "kdebase3", so if=
=20
KDE3 is installed on your system(s), you should be vulnerable.

This vulnerability can be used by a local attacker to gain root privileges.=
An=20
exploit has already been written by me, but I will not release it before=20
October 20th.


Workaround:
As there is no SuSE patch available yet, you will have to fix this yourself=
=2E=20
You can use the following quick'n'dirty patch to fix the issue. Note howeve=
r=20
that I am NOT responsible if you mess up your system! You should know what=
=20
you're doing!

In the mentioned script you should replace _every_ occurrence of

$r/tmp/susewm.$$

with the following:

$r/root/susewm.$$

It's not pretty, but it should work.

This advisory, contact information and the exploit can be found at=20
http://www.hu-berlin.de/~nordhaus/sec/vul/index.html

=2D-
You cannot spell "believe" without "lie".

[Roman Drahtmueller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I am answering both mails from Stefan Nordhausen to bugtraq, about symlink
race conditions in the packages susewm (1) and javarunt (Java Runtime
Environment) (2).

> Affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0=A0SuSE Linux 8.2Pro
> Not affected:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE Linux 7.3Pro, non-SuSE=
distributions
> Possibly affected:=A0=A0=A0=A0=A0=A0other SuSE distributions
> Vulnerable package:=A0=A0=A0=A0=A0susewm
>=20
> Impact:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= A0=A0=A0Local user can =
gain root privileges
> Exploit type:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0Symlink attack
> Release date:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0October 6th 2003
> Vendor status:=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0SuSE was contacted on Septemb=
er 4th (> 1 month ago).
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A 0=A0=A0=A0=A0=A0=A0=A0N=
o SuSE-patch yet.
>=20
>=20
> A symlink vulnerability exists in the shell script=20
> /sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the=
=20
> "susewm" package. This package is required by the package "kdebase3", so =
if=20
> KDE3 is installed on your system(s), you should be vulnerable.

These bugs are confirmed and are being processed, according to their
severity. Which also means that these two bugs have been superseded by
more severe ones in our queue.
There will soon be update packages for the affected products, of course.

We thank Stefan Nordhausen for notifying these weaknesses to SuSE
Security.

Thanks,
Roman Drahtm=FCller,
SuSE Security.
- --=20
- -
| Roman Drahtm=FCller <draht@suse.de> // Nail here |
SuSE Linux AG - Security Phone: // for a new =20
| N=FCrnberg, Germany +49-911-740530 // monitor! --> [x] |
- -
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: SuSE Security

iD8DBQE/gbNjnkDjEAAKq6QRAqL0AKDOFeRm053retTs93C6/c4/MrjEUQCgiFsP
9AsZLOeBHN+ihvMl7WOOuBE=3D
=3DrORi
-----END PGP SIGNATURE-----