Onderwerp: SuSEs YaST Online Update - possible symlink attack

author:l0om - l0om[at]excluded.org - www.excluded.org
date:05.04.2004
product:SuSE 9.0 maybe lower

possible symlink attack in SuSEs YOU [YaST Online
Update]

in SuSE linux you can use YOU to auto update your
system.
you can do this by YaST or by hand with the command
"online_update".
as a normal user you can check for updates with the
options "-q" or "-k".
By doing this "online_update" will do the follwing:
creats a directory in /usr/tmp/you-$USER
in this direcoty it will creat the files "cookies",
"quickcheack" and "youservers" (furthermore
it creats some directorys- nevermind...).
it doesnt check for a allready existing directory
called "you-$USER" or for files like "cookies"
which may be there.

an attacker could create a directory like "/usr/tmp/
you-asdf" and put a link
there named "cookies" which points to a file in /
home/asdf he likes to overwrite.
then he should set the directory permissions on 777
otherwise the binary will fail to create files
in /usr/tmp/asdf.
now he have to get the user asdf to execute the "/
usr/bin/online_update" binary (maybe by mail or
write) and the file will be overwritten.

bye and have a lot of phun
l0om

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> =20
> possible symlink attack in SuSEs YOU [YaST Online=20
> Update]=20
> in SuSE linux you can use YOU to auto update your system. you can do
> this by YaST or by hand with the command "online_update". as a normal
> user you can check for updates with the options "-q" or "-k". By doing
> this "online_update" will do the follwing: creats a directory in
> /usr/tmp/you-$USER in this direcoty it will creat the files "cookies",
> "quickcheack" and "youservers" (furthermore it creats some directorys-
> nevermind...). it doesnt check for a allready existing directory called
> "you-$USER" or for files like "cookies" which may be there.
> =20

The problem is present in SUSE Linux 8.2 and 9.0. SUSE Linux releases
before 8.2 are not affected.=20
Update packages for YOU will be released within the following days. They
fix the vulnerability by using the user's home directory for storing the
information about possibly pending updates. It should be noted that YOU
(Yast Online Update) needs (of course) to be run as root to be able to not
only check for updates, but to be able to actually install them.

> bye and have a lot of phun=20
> =09l0om=20

As usual, we appreciate notices about security vulnerabilities at=20
security@suse.com, in particular because of lagged mailing lists.
Encryption keys, detailed contact information, statements, announcements,
useful links and other information can be found on the SUSE Security main
website at http://www.suse.de/security/.

Thanks,
Roman Drahtm=FCller,
SUSE Security.
- --=20
- -
| Roman Drahtm=FCller <draht@suse.de> // "You don't need eyes to see, =
|
SUSE Linux AG - Security Phone: // you need vision!"
| N=FCrnberg, Germany +49-911-740530 // Maxi Jazz, Faithless =
|
- -
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: SUSE Security

iD8DBQFAc1R9nkDjEAAKq6QRAg7zAJ95HPW540RGkkDfNNajsp L9JDfDsQCgj2Mn
VjvJ6TllMJKod4+xAgx/reo=3D
=3DRgTg
-----END PGP SIGNATURE-----