Maped is a setuid binary that belongs to LuxMan. It executes gzip without using the full path. A local attacker can create an exploit binary named gzip and have maped execute it by properly modifying the path environment variable. The following is a sample run and explanation of an exploit that will duplicate /dev/mem to /tmp/mem:
First, the attacker sets the current working directory into the path environment variable:
farmer@debian30:~$ cd /proc/5197/fd/
farmer@debian30:~$ ls -l
total 0
lrwx------ 1 farmer farmer 64 Oct 10 05:56 0 -> /dev/pts/1
l-wx------ 1 farmer farmer 64 Oct 10 05:56 1 -> pipe:[4991]
lrwx------ 1 farmer farmer 64 Oct 10 05:56 2 -> /dev/pts/1
lrwx------ 1 farmer farmer 64 Oct 10 05:56 3 -> /tmp/mem
lr-x------ 1 farmer farmer 64 Oct 10 05:56 4 -> /dev/zero
lrwx------ 1 farmer farmer 64 Oct 10 05:56 5 -> /dev/mem
It is clear that descriptor 5 is a read write descriptor to /dev/mem.
Analysis:
Any local user can launch this attack to gain read/write access to /dev/mem. Such access can lead to local root compromise. Exploitation is possible by scanning the file for fragments of the master password file and modifying kernel memory to re-map system calls.
Detection:
LuxMan 0.41, which is packaged and distributed with Debian Linux 3.0r0, is vulnerable. It is probable that the same LuxMan version is vulnerable on other platforms as well.
Workaround:
Customers should consider one of the two following options:
Option 1: Remove the LuxMan package by issuing the command "# apt-get remove luxman".
Option 2: Remove the setuid bit from the maped binary by executing the command "# chmod -s `which maped`".
Vendor response:
The Debian Project has made available an updated LuxMan package that fixes this vulnerability. More information should be available in DSA-189 at http://www.debian.org/security/2002/dsa-189 Disclosure timeline:
10/03/2002 Issue disclosed to iDEFENSE
10/31/2002 Maintainer, Janos Lenart (ocsi@debian.org), and security@debian.org notified
10/31/2002 iDEFENSE clients notified
11/02/2002 Responses received from ocsi@debian.org and Martin Schulze
11/06/2002 Public disclosure
