from a bugtraq email by Lu
from a bugtraq email by Luís Miguel Silva <lms@fe.up.pt>: At least one of the scripts that ships with this software (opcontrol) has a security flaw which enables a user to run arbitrary commands. The script itself isnt suid root *but*, to take full advantage of some of the features the software has, a lot of administrators give 'sudo' privileges to that script. Whoever coded the script tried protecting it against executing binaries out of a safe PATH by defining one on line 1416: PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin The problem is that this script does not check where the 'which' or 'dirname' binary is executed from on line 1413/1414. This enables a malicious user to execute arbitrary code by using the following pseudo'exploit': cat > which #!/bin/sh /bin/cp /bin/bash /tmp/backdoor /bin/chmod 6755 /tmp/backdoor ^C set PATH="." /usr/bin/sudo /usr/local/bin/opcontrol Vulnerable: <= oprofile-0.9.1 I contacted the developer(s) and got the following response: "Do not trust admin privileges to unaudited code" - indeed these are words of wisdom :o)
spock please provide fixed ebuilds, thanks
Fixed ebuilds are now in the tree. Please note that this whole bug is probably a non-issue for Gentoo systems since our sudo is compiled with the '--with-secure-path' option.
Auditors please confirm taht we are not affected...
Confirmed, Michael is correct, this is not exploitable on gentoo.
