[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) root compromise / VU#433821
-----BEGIN PGP SIGNED MESSAGE-----
Unprivileged local users can obtain root access on Unix systems where
the DISA SRR scripts are run. If a remote user can introduce a file
into the filesystem (e.g. anonymous ftp, http upload, cdrom, samba
share, etc.), root access may be obtained by remote, and potentially
The U.S. Defense Information Systems Agency (DISA) publishes Security
Readiness Review scripts (SRRs) to ensure systems and software meet
security baselines required by the Department of Defense. The SRRs are
commonly run on military systems and DISA makes them available to other
government agencies and the general public (at their own risk) at
This vulnerability report applies to the current (October 15, 2009) Unix
SRR. It was tested on Solaris/x86 only but is expected to be applicable
to all Unix/Linux versions supported by the software. DISA publishes
SRR updates approximately once every two months and it is believed that
many previous versions are also vulnerable.
DISA also publishes SRR scripts for other software/operating systems
(e.g. Windows Vista, Oracle database, Open VMS). These could contain
similar vulnerabilities (I haven't gone looking for them).
The Unix SRR must be run as root and one of the first things it does is
a global find from /. It then runs a series of modular scripts looking
for specific vulnerabilities or Potential Discrepancy Items (PDIs).
Some of the PDIs include checks for specific versions of software.
Unfortunately, in some cases, it runs these unknown/untrusted/suspect
programs as root in an attempt to determine the version of the software
The following programs are known to be run:
An attacker can, for example, create an executable or shell script with
a root kit installer called "php", anywhere in the filesystem. When the
SRR is run, it will execute "php -v" as root and the root kit will be
installed. A clever attacker could print out the "good" version string
of php and silently install the root kit. A very clever attacker could
do the above and then replace the fake php with the real one, covering
Do not run the DISA Unix SRR script until a fix is available.
The publisher should do a comprehensive review of their software to make
sure they eliminate all cases where they execute
unknown/untrusted/suspect code as root. Ideally, they should not
execute such code at all, even as an unprivileged user. A better
approach would be to use "strings" or something similar to look for a
signature to try to determine the version of the software it found.
Reported to CERT Coordination Center September 21, 2009. Assigned
tracking number VU#433821.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
org:F. Stuart Consulting, LLC
title:Owner, Senior Unix Consultant