Date: Mon, 6 Oct 2003 15:06:57 +0200
From: Stefan Nordhausen <[email protected]>
To: [email protected]Subject: Local root exploit in SuSE Linux 7.3Pro
Affected: =A0 =A0 =A0 =A0 =A0 =A0=A0=A0=A0SuSE Linux 7.3Pro
Not affected: =A0 =A0 =A0 =A0=A0=A0=A0SuSE Linux 8.2Pro, non-SuSE distribut=
ions
Possibly affected: =A0=A0=A0=A0=A0other SuSE distributions
Vulnerable package: =A0=A0=A0=A0javarunt
Impact: =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0=A0=A0Local user can gain root privil=
eges
Exploit type: =A0 =A0 =A0 =A0=A0=A0=A0Symlink attack
Release date: =A0 =A0 =A0 =A0=A0=A0=A0October 6th 2003
Vendor status: =A0 =A0 =A0=A0=A0=A0=A0SuSE was contacted on September 4th (=
> 1 month ago).
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0=A0=A0No SuSE-patch yet.
A symlink vulnerability exists in the shell script=20
/sbin/conf.d/SuSEconfig.javarunt. This file is part of the package "javarun=
t"=20
(Java runtime environment).
This vulnerability can be used by a local attacker to gain root privileges.=
An=20
exploit has already been written by me, but I will not release it before=20
October 20th.
Workaround:
As there is no SuSE patch available yet, you will have to fix this yourself=
=2E=20
You can use the following quick'n'dirty patch to fix the issue. Note howeve=
r=20
that I am NOT responsible if you mess up your system! You should know what=
=20
you're doing!
In the mentioned script you should replace _every_ occurrence of
/tmp/.java_wrapper
with the following:
/root/.java_wrapper.$$
Again, this is not pretty but it should work.
This advisory, contact information and the exploit can be found at=20
http://www.hu-berlin.de/~nordhaus/sec/vul/index.html
=2D-
Beware of he, who would deny you access to information. For in his heart, h=
e=20
dreams himself your master.
