Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: SuSE Local Security Checks --> Category: infos

SUSE-SA:2005:062: permissions Vulnerability Scan

Vulnerability Scan Summary
Check for the version of the permissions package

Detailed Explanation for this Vulnerability Test

The remote host is missing the patch for the advisory SUSE-SA:2005:062 (permissions).

SUSE LINUX ships with three pre defined sets of permissions, 'easy',
'secure' and 'paranoid'. The chkstat program contained in the
permissions package is used to set those permissions to the chosen
level. Level 'easy' which is the default allows some world writeable
directories. /usr/src/packages/RPMS and subdirectories is among
them. To prevent users from playing tricks in there e.g. linking to
/etc/shadow chkstat doesn't touch symlinks or files with an hardlink
count != 1.

Stefan Nordhausen discovered a way to trick this check. To gain
access to e.g. /etc/shadow a malicious user has to place a hardlink
to that file at a place that is modified by chkstat. chkstat will
not touch the file because it has a hardlink count of two. However,
if the administrator modifies the user database the original
/etc/shadow gets deleted and replaced by a new one. That means the
hardlink count of the file created by the malicious user drops to
one. At this point chkstat will modify the file's permissions so
anyone can read it. So it's technically impossible for chkstat to
modify permissions of files in world writeable directories in a
secure way.

One such world writeable directoy in level 'easy' is
/usr/src/packages/RPMS. Only subdirectories need to be adjusted in
this case. Since normal users cannot create hard links to
directories the problem can be solved by telling chkstat to not
accept regular files. Another problematic directory is /var/games.
Only members of group 'games' may write to it but it's likely that
games with setgid 'games' are exploitable to allow user to gain
group 'games' membership.

The updated permissions package now tells chkstat when to only
accept directories and no longer touches anything below /var/games
to solve the described problems. On SUSE Linux 9.0 xmcd contained
world writeable directories that suffered from the same problems.
Updated xmcd packages for SUSE Linux 9.0 are therefore provided as

We like to thank Stefan Nordhausen for pointing out the problems.

Solution :
Threat Level: Medium

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.